CVE-2026-44994

OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint

Published May 11, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sensitive configuration fields. Attackers can access the bootstrap config route without a valid Gateway token to expose sensitive bootstrap and config information intended only for authenticated Control UI sessions.

Analysis

Technical impact

Prior to version 2026.4.22, OpenClaw’s Control UI bootstrap configuration endpoint can be accessed without providing a valid Gateway token, allowing anyone who can reach the endpoint to read sensitive bootstrap and configuration data. The weakness is categorized as an authentication bypass (CWE‑862) and effectively leaks information that should be protected to authenticated sessions.

Affected Systems

The vulnerability affects all installations of OpenClaw OpenClaw that are operating on a Node.js environment and whose version is earlier than 2026.4.22. No newer releases are known to contain this flaw.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. As EPSS data is not available and the issue is not listed in the CISA KEV catalog, the current risk is driven primarily by the ease of exploitation; an unauthenticated attacker with network access to the Control UI can read sensitive configuration values. The impact is limited to information disclosure rather than remote code execution or denial of service, but the exposed data could assist further attacks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`0`	affected	< 2026.4.22
`2026.4.22`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[0,2026.4.22)`	affected	semver	—
`2026.4.22`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenClaw to version 2026.4.22 or later
Restrict network traffic to the Control UI bootstrap config endpoint by limiting it to trusted IP ranges
Configure a firewall or reverse proxy to block unauthenticated HTTP requests to the bootstrap config route

Generated by OpenCVE AI on May 11, 2026 at 18:42 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.317% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/openclaw/commit/2321d67263bc710e357644d59f746b08d891051b
https://github.com/openclaw/openclaw/security/advisories/GHSA-93rg-2xm5-2p9v
https://www.vulncheck.com/advisories/openclaw-authentication-bypass-in-gateway-control-ui-bootstrap-config-endpoint

History

May 11, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 11, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sensitive configuration fields. Attackers can access the bootstrap config route without a valid Gateway token to expose sensitive bootstrap and config information intended only for authenticated Control UI sessions.
Title		OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-862
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/commit/2321d67263bc710e357644d59f746b08d891051b https://github.com/openclaw/openclaw/security/advisories/GHSA-93rg-2xm5-2p9v https://www.vulncheck.com/advisories/openclaw-authentication-bypass-in-gateway-control-ui-bootstrap-config-endpoint
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`