Openclaw cli: OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning (CVE-2026-26327)

OpenClaw CLI's discovery beacons include unauthenticated TXT records such as lanHost, tailnetDns, gatewayPort, and gatewayTlsSha256. Prior to the fix, iOS and macOS clients used these TXT values as authoritative routing and port information, while iOS and Android clients allowed discovery-provided TLS fingerprints to override stored TLS pins. An attacker on a shared or untrusted LAN could advertise a rogue _openclaw-gw._tcp service, causing clients to connect to attacker-controlled endpoints and accept attacker certificates, potentially exposing Gateway credentials. The vulnerability affects openclaw npm package versions from 2026.1.29 up to but not including 2026.2.14. The patch changes clients to prefer SRV and A/AAAA records over TXT routing hints, disables discovery-based TLS pin overrides, requires explicit user confirmation for TLS pinning on iOS/Android, enforces TLS-only direct connects, and restores hostname verification on Android except when pinning.

An attacker on a shared or untrusted LAN can exploit this vulnerability to redirect client connections to malicious endpoints and bypass TLS pinning protections, potentially leading to exposure of Gateway authentication credentials such as auth.token and auth.password. The practical impact is limited due to the affected iOS and Android clients being in alpha or testing stages and not broadly released. Other shipped clients relying on discovery on shared LANs may also be affected.

A patch is available and planned for openclaw CLI version 2026.2.14. Users should upgrade to this version once released. The fix ensures clients prefer resolved service endpoints (SRV + A/AAAA) over TXT records for routing, disables discovery-based TLS pin overrides, and requires explicit user confirmation for TLS pinning on iOS and Android. Until the patch is applied, avoid using openclaw clients on untrusted or shared LANs to reduce risk.