OpenClaw improper authentication in Gateway Control UI bootstrap config

Executive brief

OpenClaw is a software gateway and control interface. A vulnerability in the Control UI allowed unauthenticated users to access sensitive configuration data that should have been protected by a login. This could lead to the exposure of internal system settings or bootstrap information to unauthorized parties.

Technical details

An improper authentication vulnerability (CWE-287) exists in the OpenClaw npm package. When Gateway authentication is enabled, the Control UI bootstrap configuration endpoint fails to verify the presence of a valid Gateway token. This allows a remote, unauthenticated attacker to access the bootstrap/config route and retrieve sensitive configuration fields intended only for authenticated sessions. The issue was addressed in version 2026.4.22 by routing the bootstrap config path through the standard Gateway read-authentication logic.

Affected products

• OpenClaw openclaw <= 2026.4.21

Timeline

• 2026-04-23: patched: Fix commit 2321d67 pushed and version 2026.4.22 published to npm.
• 2026-05-04: advisory: GitHub Advisory GHSA-93rg-2xm5-2p9v published.

References

• https://api.github.com/users/zsxsoft
• https://github.com/zsxsoft
• https://api.github.com/users/zsxsoft/gists%7B/gist_id%7D
• https://api.github.com/users/zsxsoft/repos
• https://avatars.githubusercontent.com/u/2398785?v=4
• https://api.github.com/users/zsxsoft/events%7B/privacy%7D