OpenClaw before 2026.4.14 contains a redaction bypass that enables authenticated gateway clients to retrieve secrets that should have been hidden. The flaw sits in the handling of sourceConfig and runtimeConfig alias fields, permitting an attacker with sufficient read permissions to read provider API keys, gateway authentication credentials, and channel secrets. The result is a confidentiality violation exposing highly sensitive material to compromised users.

The affected product is OpenClaw, and all releases older than 2026.4.14 are vulnerable. The fix was applied in the 2026.4.14 release, as indicated by the referenced commit and advisory. This version change is required to eliminate the inability to obtain non‑redacted information through the alias fields.

The vulnerability scores a CVSS of 7.1, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to have authenticated access with configuration read rights, which is a permission commonly granted to gateway users. Because of the confidentiality impact and the typical scope of these permissions, the risk is significant for organizations that rely on OpenClaw for secure handling of gateway secrets.