Executive brief
OpenClaw is a tool used for service discovery and management. A vulnerability in its command-line interface (CLI) allows malicious network metadata to redirect traffic to unauthorized targets even when the intended service fails to connect. This could lead to minor data exposure or unauthorized interaction with rogue services on the local network.
Technical details
A vulnerability exists in OpenClaw's service discovery mechanism where Bonjour and DNS-SD TXT metadata are improperly handled. Specifically, the CLI routing logic in `src/cli/gateway-cli/discover.ts` may use host and port hints from TXT records even if the primary service resolution fails. An attacker on the same local network (adjacent) could broadcast malicious DNS-SD metadata to influence the target endpoint chosen by the CLI. This is classified as insufficient verification of data authenticity (CWE-345). The issue is fixed in version 2026.3.22 by ensuring the discovery process only returns concrete, successfully resolved endpoints.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-24: disclosed
- 2026-03-26: advisory
- 2026-03-22: patched