En resumen
- CVE-2026-35644 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a openclaw (openclaw), openclaw.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.19%, mayor que el 9.1% de las vulnerabilidades.
- Solución: actualizar a 2026.3.22 o posterior.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.22
| 2026.3.22
|
| openclaw npm | < 2026.3.22
| 2026.3.22
|
Description
Summary
Read-scoped gateway snapshots could expose credentials embedded in channel baseUrl and related endpoint fields.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
- Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
f0202264d0de7ad345382b9008c5963bcefb01b7
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- src/channels/account-snapshot-fields.ts now strips URL userinfo from channel status snapshot fields.
- src/config/redact-snapshot.ts now redacts credential-bearing baseUrl and httpUrl fields while preserving safe context.
OpenClaw thanks @zpbrent for reporting.
NVD description
OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication information from URL userinfo components.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free