OpenClaw's Gateway Control UI bootstrap configuration endpoint was accessible without proper Gateway authentication in versions up to 2026.4.21. This could expose sensitive bootstrap and configuration fields intended only for authenticated sessions. The issue was fixed in version 2026.4.22 by enforcing the same Gateway read-authentication on the bootstrap config route as other Control UI reads.