CVE-2026-40045: OpenClaw Information Disclosure Flaw

CVE-2026-40045 Overview

CVE-2026-40045 affects OpenClaw versions prior to 2026.4.2. The application accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted WebSocket connections. Attackers on the same adjacent network can forge discovery results or craft setup codes that redirect clients toward malicious endpoints. The redirected client then discloses plaintext gateway credentials to the attacker-controlled host. The flaw is categorized under [CWE-319] Cleartext Transmission of Sensitive Information.

Critical Impact
Adjacent-network attackers can capture or coerce disclosure of gateway authentication tokens, enabling full impersonation of legitimate clients against the OpenClaw gateway.

Affected Products

OpenClaw (openclaw:openclaw) Node.js distribution, all versions before 2026.4.2
OpenClaw Android client component NodeRuntime.kt
Deployments relying on the unpatched GatewayHostSecurity validation logic

Discovery Timeline

2026-04-21 - CVE-2026-40045 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-40045

Vulnerability Analysis

OpenClaw clients establish gateway sessions over WebSocket transports. Before version 2026.4.2, the client accepted any ws:// scheme regardless of whether the destination host was a loopback address. The runtime then transmitted stored bearer tokens and credentials inside the initial connection frames without TLS encapsulation. Because the gateway endpoint URL could be sourced from network discovery responses or QR-style setup codes, an attacker did not need to compromise the client directly. Supplying a tainted endpoint string was sufficient to redirect the credential exchange to an attacker-controlled listener.

Root Cause

The NodeRuntime initialization path did not enforce a TLS requirement for remote hosts. The codebase lacked a centralized helper to determine whether a target host was a loopback interface. Without that gate, the runtime treated cleartext WebSocket transports as acceptable for any destination, including routable IPv4 and IPv6 addresses on the local network.

Attack Vector

Exploitation requires adjacent network access and user interaction during gateway pairing or discovery. An attacker poisons discovery results, spoofs mDNS responses, or distributes crafted setup codes pointing to ws://attacker.lan:port. When the victim client connects, it transmits its gateway credentials in plaintext. The attacker then replays those credentials against the legitimate gateway.

The upstream fix introduces an explicit loopback check and a TLS fingerprint probe before any remote connection is permitted:

kotlin

internal fun isLoopbackGatewayHost(
  rawHost: String?,
  allowEmulatorBridgeAlias: Boolean = isAndroidEmulatorRuntime(),
): Boolean {
  var host =
    rawHost
      ?.trim()
      ?.lowercase(Locale.US)
      ?.trim('[', ']')
      .orEmpty()
  if (host.endsWith(".")) {
    host = host.dropLast(1)
  }
  val zoneIndex = host.indexOf('%')
  if (zoneIndex >= 0) {
    host = host.substring(0, zoneIndex)
  }
  if (host.isEmpty()) return false
  if (host == "localhost") return true
  if (allowEmulatorBridgeAlias && host == "10.0.2.2") return true

  parseIpv4Address(host)?.let { ipv4 ->
    return ipv4.first() == 127.toByte()
  }
}

Source: OpenClaw commit a941a4f

Detection Methods for CVE-2026-40045

Indicators of Compromise

Outbound WebSocket connections from OpenClaw clients using the ws:// scheme to non-loopback addresses
Unexpected gateway endpoints observed in OpenClaw client logs that do not resolve to 127.0.0.0/8, ::1, or the Android emulator alias 10.0.2.2
mDNS or service-discovery responses advertising OpenClaw gateways on plaintext ports

Detection Strategies

Inspect network captures for OpenClaw Upgrade: websocket handshakes lacking TLS, especially those carrying Authorization or token headers
Audit application configuration stores for persisted gateway URLs that begin with ws:// and point to routable hosts
Correlate gateway authentication anomalies, such as repeated logins from new source addresses, with client pairing events

Monitoring Recommendations

Enable NetFlow or packet inspection on segments where OpenClaw clients operate to flag cleartext WebSocket sessions
Alert on first-seen gateway hostnames in client telemetry to detect endpoint redirection attempts
Centralize OpenClaw client logs to identify pairing events that bypassed TLS fingerprint verification

How to Mitigate CVE-2026-40045

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.2 or later, which enforces TLS for non-loopback gateway endpoints
Rotate all gateway credentials and bearer tokens that may have transited unencrypted WebSocket sessions
Re-pair existing clients using wss:// endpoints and validate server TLS fingerprints

Patch Information

The vendor fix is published in commit a941a4fef9bc43b2973c92d0dcff5b8a426210c5 and tracked under the advisory GHSA-83f3-hh45-vfw9. The patch adds the GatewayHostSecurity module and a TLS fingerprint probe to NodeRuntime, rejecting any remote endpoint that does not negotiate TLS. Additional context is available in the VulnCheck advisory on cleartext credential transmission.

Workarounds

Restrict OpenClaw clients to loopback gateway endpoints only until the upgrade is applied
Deploy clients on isolated network segments and disable mDNS-based gateway discovery
Enforce network policy that blocks ws:// traffic on all OpenClaw-related ports, requiring wss:// connections
Use SentinelOne Singularity Endpoint behavioral telemetry to identify OpenClaw client processes initiating cleartext WebSocket connections to non-loopback hosts

bash

# Verify installed OpenClaw version and block cleartext WebSocket egress
npm ls openclaw
iptables -A OUTPUT -p tcp --dport 80 -m string --string "GET /gateway" --algo bm -j REJECT