CVE-2026-44994 Overview
CVE-2026-44994 is an authentication bypass vulnerability in OpenClaw versions before 2026.4.22. The flaw resides in the Gateway Control UI bootstrap config endpoint, which fails to verify a valid Gateway token before returning configuration data. Unauthenticated attackers can query the bootstrap config route over the network and read sensitive bootstrap and configuration fields intended exclusively for authenticated Control UI sessions. The weakness is categorized as missing authorization [CWE-862] and affects the openclaw:openclaw Node.js component.
Critical Impact
Remote unauthenticated attackers can retrieve sensitive Control UI bootstrap and configuration data from the Gateway without supplying a Gateway token.
Affected Products
- OpenClaw (openclaw:openclaw) versions prior to 2026.4.22
- OpenClaw Gateway Control UI bootstrap config endpoint
- Node.js deployments of OpenClaw Gateway
Discovery Timeline
- 2026-05-11 - CVE-2026-44994 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-44994
Vulnerability Analysis
The OpenClaw Gateway exposes a Control UI bootstrap config route that returns the runtime configuration snapshot consumed by the Control UI on load. In affected versions, the handler returns this payload without requiring a resolved Gateway authentication context. Attackers can issue a direct HTTP request to the bootstrap config endpoint and receive sensitive configuration fields without presenting a Gateway token.
The exposed data is intended only for authenticated administrative sessions. Disclosure of configuration material can include agent identity values, gateway routing details, and other operational parameters that aid follow-on attacks against the deployment.
Root Cause
The root cause is missing authorization enforcement on the bootstrap config route in src/gateway/server-http.ts and the associated src/gateway/control-ui.ts module. The handler builds and returns the Control UI state object without binding it to a verified authentication context, trusted proxy validation, or rate limiting. This corresponds to [CWE-862] Missing Authorization.
Attack Vector
Exploitation requires only network access to the Gateway HTTP listener. An attacker sends an unauthenticated request to the Control UI bootstrap config endpoint and parses the returned JSON to extract configuration fields. No user interaction or prior credentials are required.
// Patch excerpt: src/gateway/control-ui.ts
config?: OpenClawConfig;
agentId?: string;
root?: ControlUiRootState;
+ auth?: ResolvedGatewayAuth;
+ trustedProxies?: string[];
+ allowRealIpFallback?: boolean;
+ rateLimiter?: AuthRateLimiter;
};
export type ControlUiRootState =
Source: GitHub Commit 2321d672
// Patch excerpt: src/gateway/server-http.ts
config: configSnapshot,
agentId: resolveAssistantIdentity({ cfg: configSnapshot }).agentId,
root: controlUiRoot,
+ auth: resolvedAuth,
+ trustedProxies,
+ allowRealIpFallback,
+ rateLimiter,
}),
});
}
Source: GitHub Commit 2321d672. The patch wires resolvedAuth, trustedProxies, allowRealIpFallback, and rateLimiter into the Control UI handler so the bootstrap config route enforces the Gateway authentication pipeline.
Detection Methods for CVE-2026-44994
Indicators of Compromise
- Unauthenticated HTTP requests to the Gateway Control UI bootstrap config route from non-administrative source addresses.
- Successful HTTP 200 responses to bootstrap config requests lacking a valid Gateway token or session cookie.
- Outbound retrieval of Gateway configuration fields followed by reconnaissance probes against listed agent identities or service endpoints.
Detection Strategies
- Inspect Gateway HTTP access logs for requests to the Control UI bootstrap config path that originate from IP addresses outside the administrative network.
- Alert on responses to the bootstrap config route that occur without a preceding authenticated session establishment event.
- Correlate high request rates against Control UI routes with the absence of Authorization headers or Gateway session tokens.
Monitoring Recommendations
- Forward Gateway HTTP logs to a centralized analytics platform and apply detections against the bootstrap config route.
- Monitor for new external clients accessing the Control UI surface and baseline expected administrator source ranges.
- Track configuration retrieval patterns and alert on bursts of bootstrap config requests indicative of automated scanning.
How to Mitigate CVE-2026-44994
Immediate Actions Required
- Upgrade OpenClaw to version 2026.4.22 or later, which applies commit 2321d672 enforcing authentication on the Control UI bootstrap config route.
- Restrict network access to the Gateway HTTP listener so that only trusted administrative sources can reach Control UI endpoints.
- Audit recent Gateway logs for unauthenticated requests to the bootstrap config route and review any disclosed configuration values for sensitivity.
Patch Information
The fix is delivered in OpenClaw 2026.4.22 via commit 2321d67263bc710e357644d59f746b08d891051b. The patch introduces ResolvedGatewayAuth, trustedProxies, allowRealIpFallback, and AuthRateLimiter parameters into the Control UI handler and requires authentication before returning the bootstrap config payload. Full details are available in the GitHub Security Advisory GHSA-93rg-2xm5-2p9v and the VulnCheck Advisory.
Workarounds
- Place the Gateway behind a reverse proxy that requires authentication before forwarding requests to the Control UI bootstrap config route.
- Apply network ACLs or firewall rules to limit access to the Gateway HTTP port to administrator workstations only.
- Rotate any secrets, agent identifiers, or tokens that may have been exposed via the bootstrap config endpoint prior to patching.
# Example: restrict Gateway Control UI access to an admin CIDR using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
