Openclaw cli: OpenClaw's Gateway Control UI bootstrap config required Gateway auth (CVE-2026-44994)
Description
OpenClaw CLI versions up to 2026.4.21 have a vulnerability where the Gateway Control UI bootstrap config endpoint does not require Gateway authentication, potentially exposing sensitive configuration fields. This issue is fixed in version 2026.4.22 by enforcing authentication on the bootstrap config route, aligning it with other authenticated Control UI reads.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw CLI package (npm) versions up to 2026.4.21 have a security flaw where the Control UI bootstrap config endpoint could be accessed without a valid Gateway token, even when Gateway authentication was enabled. This could lead to exposure of sensitive bootstrap/configuration fields intended only for authenticated sessions. The vulnerability is addressed in version 2026.4.22 by routing the bootstrap config endpoint through the same Gateway read-authentication path as other authenticated Control UI endpoints. Regression tests ensure proper rejection of unauthenticated requests and valid token access.
Potential Impact
Unauthorized users could read sensitive bootstrap configuration data from the Control UI without valid authentication, potentially exposing sensitive internal configuration details. There is no indication of privilege escalation or direct code execution, but sensitive information disclosure could aid further attacks.
Mitigation Recommendations
Upgrade to OpenClaw CLI version 2026.4.22 or later, which includes the fix enforcing Gateway authentication on the bootstrap config endpoint. The fix is verified by regression tests and is included in the public v2026.4.22 release. No additional mitigation is required once updated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-44994
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac2459012601ec6a31641e7
Added to database: 10/04/2026, 12:24:48 UTC
Last enriched: 10/04/2026, 12:39:25 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.