Executive brief
OpenClaw is an open-source framework for building AI agents. When configured to hash owner IDs in system prompts, the application reused the gateway authentication token as a fallback secret instead of using a dedicated hashing key. This allows attackers with access to system prompts sent to third-party AI model providers to derive the gateway authentication token, potentially compromising access controls to the OpenClaw gateway.
Technical details
OpenClaw versions prior to 2026.2.22 incorrectly reuse gateway.auth.token and gateway.remote.token as fallback hash secrets for owner-ID prompt obfuscation when commands.ownerDisplay is set to "hash" and commands.ownerDisplaySecret is unset. This dual-use of authentication secrets across security domains (gateway authentication versus prompt metadata hashing) violates the principle of secret isolation. The vulnerability requires that: (1) the hash mode is enabled for owner display, (2) the commands.ownerDisplaySecret is not configured, and (3) the attacker has visibility into system prompts sent to third-party LLM providers. An attacker can derive the gateway authentication token from hash outputs, compromising gateway authentication security. The fix (version 2026.2.22) removes the fallback to gateway tokens and auto-generates a dedicated commands.ownerDisplaySecret.
Affected products
- OpenClaw OpenClaw prior to 2026.2.22
Timeline
- 2026-02-23: disclosed
- 2026-02-23: patched: Fix version 2026.2.22 released
- 2026-03-21: advisory: This advisory published as GHSA-8mr2-f9wf-hcfq
- 2026-03-24: other: Advisory withdrawn as duplicate of GHSA-v6x2-2qvm-6gv8