Openclaw cli: OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

The OpenClaw CLI macOS Dashboard previously appended shared Gateway authentication tokens and passwords to the browser URL query string when opening the Control UI. The Control UI then imported these tokens and stored them persistently in browser localStorage under 'openclaw.control.settings.v1'. This exposed reusable Gateway admin credentials to browser-controlled surfaces, increasing the risk of credential theft. The fix, released in version 2026.3.7, changes the macOS Dashboard to pass tokens via URL fragments instead of query parameters, omits the shared password from URLs, keeps tokens only in memory for the current tab, and removes legacy persisted tokens from localStorage on load.

An attacker with access to the browser environment could extract valid Gateway admin tokens from the URL or localStorage and reuse them to access the OpenClaw management interface with administrative privileges. This exposure could lead to unauthorized control over the Gateway management functions. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

A patch is available and has been released in openclaw-cli version 2026.3.7. Users should upgrade to version 2026.3.7 or later to mitigate this vulnerability. The fix removes authentication tokens from URL query parameters, prevents storing tokens persistently in localStorage, and scrubs legacy tokens on load. No additional action is required beyond applying the update.