Threats tagged 'ghsa-5hj5-7x2h-xhpr'

OpenClaw versions before 2026.4.22 have an authentication bypass vulnerability in the Control UI bootstrap config endpoint. This flaw allows unauthenticated attackers to access sensitive configuration fields by accessing the bootstrap config route without a valid Gateway token. The vulnerability exposes configuration information intended only for authenticated Control UI sessions.