Executive brief
OpenClaw is a popular Node.js library used to build gateway control interfaces and agent systems. A flaw in the Gateway Control Interface bootstrap JSON exposed sensitive metadata including software version and assistant agent identifiers. While this is not directly exploitable for data theft or system compromise, it enables attackers to fingerprint the deployment and identify which systems are running vulnerable versions, potentially facilitating further targeted attacks.
Technical details
The vulnerability is an information disclosure (CWE-200) in OpenClaw's Gateway Control Interface bootstrap JSON response. The control UI bootstrap endpoint was exposing sensitive metadata such as the product version and assistant agent IDs without sufficient access controls. The vulnerability is reachable over the network with no authentication required. An attacker can retrieve this metadata to fingerprint the deployed version and identify infrastructure details, supporting reconnaissance for follow-on attacks. The fix (commit c5c10adc) trims the sensitive payload from the bootstrap JSON response. Patched versions 2026.3.31 and later are not affected.
Affected products
- OpenClaw OpenClaw <=2026.3.28
Timeline
- 2026-04-03: disclosed
- 2026-03-30: patched: Fix commit c5c10adc; patched version 2026.3.31 released