Prior to version 2026.4.22, OpenClaw’s Control UI bootstrap configuration endpoint can be accessed without providing a valid Gateway token, allowing anyone who can reach the endpoint to read sensitive bootstrap and configuration data. The weakness is categorized as an authentication bypass (CWE‑862) and effectively leaks information that should be protected to authenticated sessions.

The vulnerability affects all installations of OpenClaw OpenClaw that are operating on a Node.js environment and whose version is earlier than 2026.4.22. No newer releases are known to contain this flaw.

The CVSS score of 6.3 indicates moderate severity. As EPSS data is not available and the issue is not listed in the CISA KEV catalog, the current risk is driven primarily by the ease of exploitation; an unauthenticated attacker with network access to the Control UI can read sensitive configuration values. The impact is limited to information disclosure rather than remote code execution or denial of service, but the exposed data could assist further attacks.