#VU125127 Information disclosure in OpenClaw
Published: April 8, 2026
Vulnerability identifier: #VU125127
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
OpenClaw
OpenClaw
Software vendor:
OpenClaw
OpenClaw
Description
The vulnerability allows a remote attacker to disclose sensitive information and modify management settings.
The vulnerability exists due to exposure of sensitive information in the Dashboard authentication flow when opening the Control UI in the browser. A remote attacker can access browser-controlled surfaces or persistent browser storage to recover reusable Gateway admin credentials and reuse them to disclose sensitive information and modify management settings.
User interaction is required to open the Dashboard in the browser.
Remediation
Install security update from vendor's website.