OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

中 5.7CVE-2026-40045 · GHSA-83f3-hh45-vfw9 · 21/04/2026 公開 · 17/06/2026 更新

要点

CVE-2026-40045 は openclaw (openclaw), openclaw に影響する深刻度「中」 (CVSS 5.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.12%（全脆弱性の 1.6% より高い）。
対処：2026.4.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openclaw openclaw	`< 2026.4.2`	`2026.4.2`
openclaw npm	`< 2026.4.2`	`2026.4.2`

概要

Summary

Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext ws:// gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.

Impact

A user who followed a forged discovery result or scanned a crafted setup code could disclose stored gateway credentials to an attacker-controlled endpoint in plaintext. This was a transport-security bug in the Android gateway client.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

a941a4fef9bc43b2973c92d0dcff5b8a426210c5 — require TLS for remote Android gateway endpoints

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @zsxsoft for reporting.

NVD の説明

OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials.