OpenClaw versions prior to 2026.4.14 contain a vulnerability allowing authenticated gateway clients with config read access to bypass redaction protections via sourceConfig and runtimeConfig aliases. This flaw could expose sensitive secrets such as provider API keys, gateway authentication material, and channel credentials. The issue is fixed in version 2026.4.14.