EUVD-2026-25319
GHSA-fjm8-mgc9-mf65
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint leaks version and agent ID metadata only; no integrity or availability impact, and confidentiality impact is limited to low-value fingerprinting data.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and agent configurations.
AnalysisAI
OpenClaw's Control UI bootstrap HTTP endpoint exposed internal system metadata - specifically the server version string and assistant agent identifier - in its JSON response payload to any unauthenticated network client on versions up to and including 2026.3.28. This constitutes a fingerprinting/information disclosure vulnerability (CWE-497) that enables attackers to enumerate precise deployment versions and agent configurations without authentication. No active exploitation has been confirmed (not in CISA KEV, EPSS 0.03%), and the maintainer assessed severity as low-narrow; a patched release (2026.3.31) was published 2026-03-30.
Technical ContextAI
OpenClaw is a TypeScript/Node.js gateway framework published on npm (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*). The vulnerable component is the handleControlUiHttpRequest function in src/gateway/control-ui.ts, which serializes a ControlUiBootstrapConfig object as the bootstrap JSON response for the Control UI frontend. Prior to commit c5c10adc, this payload included two fields: assistantAgentId (the internal agent identity string, e.g. 'main') and serverVersion (resolved at runtime via resolveRuntimeServiceVersion(process.env)). CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere - directly describes the root cause: internal runtime metadata that should be confined to trusted internal consumers was serialized into an externally accessible, unauthenticated HTTP response. The fix removes both fields from the TypeScript type definition and the HTTP response builder, and updates tests to assert their absence.
RemediationAI
Upgrade the openclaw npm package to version 2026.3.31 or later. This version contains fix commit c5c10adc022f42eb75ebb3bf364dd607738683b3, which removes the assistantAgentId and serverVersion fields from both the TypeScript contract type (ControlUiBootstrapConfig) and the HTTP response builder in handleControlUiHttpRequest. The authoritative advisory is at https://github.com/openclaw/openclaw/security/advisories/GHSA-hr8g-2q7x-3f4w and the patch commit at https://github.com/openclaw/openclaw/commit/c5c10adc022f42eb75ebb3bf364dd607738683b3. If an immediate upgrade is not feasible, restrict network access to the Control UI endpoint using a reverse proxy or firewall ACL to limit access to trusted internal clients only - this compensating control eliminates external exposure but may affect legitimate UI functionality if the Control UI is consumed by remote users.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today