Executive brief
OpenClaw is a mobile application that connects to smart home gateway devices. The Android version accepted unencrypted (cleartext) WebSocket connections and transmitted stored gateway credentials over these insecure connections. An attacker could trick users into connecting to a malicious gateway endpoint by forging discovery results or crafted setup codes, thereby stealing their credentials in plaintext.
Technical details
The vulnerability is a transport-security flaw (CWE-200, CWE-319) in which the Android client failed to enforce TLS/SSL encryption for remote gateway endpoints, instead accepting cleartext ws:// (unencrypted WebSocket) connections. When a user followed a forged discovery beacon or scanned a malicious setup code, the client would connect to an attacker-controlled endpoint and transmit stored gateway credentials over the unencrypted channel. The attack requires user interaction (scanning a code or accepting a discovery result) but no authentication. The fix, deployed in version 2026.4.2, requires TLS encryption for all remote gateway endpoints.
Affected products
- OpenClaw OpenClaw <=2026.4.1
Timeline
- 2026-04-07: disclosed
- 2026-04-02: patched: Fix committed; staged for release in 2026.4.2