Openclaw cli: OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws:// (CVE-2026-40045)

Before OpenClaw version 2026.4.2, the Android client accepted non-loopback cleartext WebSocket (ws://) gateway endpoints and transmitted stored gateway credentials over these unencrypted connections. An attacker could exploit this by providing a forged discovery beacon or setup code that directs the client to connect to an attacker-controlled cleartext remote endpoint, thereby capturing the credentials in plaintext. The vulnerability is a transport security flaw in the Android gateway client. The fix, committed in a941a4fef9bc43b2973c92d0dcff5b8a426210c5, enforces the use of TLS for remote gateway endpoints starting from version 2026.4.2.

An attacker who can trick a user into connecting to a malicious discovery beacon or setup code can intercept stored gateway credentials sent in plaintext over an unencrypted WebSocket connection. This compromises the confidentiality of the credentials but does not affect integrity or availability. The CVSS 3.1 score is 5.7 (medium severity), reflecting the attack vector requiring user interaction and the impact limited to credential disclosure.

A patch is available in OpenClaw version 2026.4.2 and later, which requires TLS for remote Android gateway endpoints, preventing the transmission of credentials over cleartext connections. Users should upgrade to version 2026.4.2 or later once it is published. Until then, avoid connecting to untrusted discovery beacons or setup codes that could direct the client to cleartext endpoints.