Executive brief
OpenClaw is a Node.js library for managing configuration and secrets in gateway applications. An authenticated user with config read access could extract unredacted sensitive data—including API keys, authentication tokens, and channel credentials—through alias fields (sourceConfig and runtimeConfig) that were not properly redacted before being returned by the config.get function.
Technical details
OpenClaw's redactConfigSnapshot() function suffered from an incomplete redaction vulnerability. The function used object spread syntax to copy the snapshot, then only overwrote the deprecated alias fields (config and resolved) with redacted copies, leaving the canonical alias fields (sourceConfig and runtimeConfig) pointing to original unredacted objects. An authenticated gateway client holding operator.read scope could call config.get and receive the full unredacted snapshot, exposing all stored secrets. The vulnerability affected all versions prior to 2026.4.14; the fix explicitly overwrites both sourceConfig and runtimeConfig with their redacted counterparts and adds test coverage for both fields. No network or scope model changes were required—the fix simply ensures the redaction contract is honored for all alias fields.
Affected products
- OpenClaw OpenClaw < 2026.4.14
Timeline
- 2026-04-17: disclosed: Advisory GHSA-8372-7vhw-cm6q published
- 2026-04-14: patched: Fix merged in PR #66030; version 2026.4.14 released