The vulnerability allows non‑admin authenticated clients to view configuration metadata in Gateway connect snapshots. This information includes host‑specific file system paths and deployment details. Exposure of such data can be used for host fingerprinting and to facilitate further attacks. The weakness corresponds to CWE‑497, which identifies insufficient data protection during protocol execution.

Affected systems are all OpenClaw deployments running any version earlier than 2026.4.2. The product is delivered as OpenClaw, built on node.js.

The CVSS base score is 5.3, indicating moderate impact for a non‑admin authenticated attacker. The EPSS probability is less than 1 %, implying a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: an authenticated non‑admin client can trigger the Gateway connect process and receive the snapshot payload, from which the metadata is parsed. Because no elevated privileges are required and the CVSS does not factor in privilege escalation, the risk is limited to information exposure unless an attacker can combine this with other weaknesses in the same system.