Kurz gesagt
- CVE-2026-35644 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in openclaw (openclaw), openclaw.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.19%, höher als bei 9.1% aller Schwachstellen.
- Abhilfe: auf 2026.3.22 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.22
| 2026.3.22
|
| openclaw npm | < 2026.3.22
| 2026.3.22
|
Description
Summary
Read-scoped gateway snapshots could expose credentials embedded in channel baseUrl and related endpoint fields.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
- Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
f0202264d0de7ad345382b9008c5963bcefb01b7
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- src/channels/account-snapshot-fields.ts now strips URL userinfo from channel status snapshot fields.
- src/config/redact-snapshot.ts now redacts credential-bearing baseUrl and httpUrl fields while preserving safe context.
OpenClaw thanks @zpbrent for reporting.
NVD description
OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication information from URL userinfo components.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free