CVE-2026-26327: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26327 is a vulnerability in OpenClaw, a personal AI assistant, where unauthenticated Bonjour/mDNS and DNS-SD discovery TXT records could be used to steer client routing and override TLS pinning. Reported by researcher @simecek and disclosed on February 15, 2026, it affects all OpenClaw npm package versions prior to 2026.2.14. The vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity) and carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is that OpenClaw's discovery mechanism (Bonjour/mDNS and DNS-SD) broadcasts TXT records containing routing and security-sensitive fields — lanHost, tailnetDns, gatewayPort, and gatewayTlsSha256 — without any authentication or integrity protection (CWE-345). Prior to version 2026.2.14, iOS and macOS clients used TXT-provided host hints and ports to construct the gateway connection URL, while iOS and Android clients allowed the discovery-provided TLS fingerprint (gatewayTlsSha256) to override a previously stored TLS pin. An attacker on the same LAN could advertise a rogue _openclaw-gw._tcp service with crafted TXT records, redirecting clients to an attacker-controlled endpoint and/or causing them to accept an attacker-supplied certificate (GitHub Advisory, Fix Commit).

Successful exploitation on a shared or untrusted LAN could cause OpenClaw clients to connect to an attacker-controlled gateway endpoint and accept an attacker's TLS certificate, enabling interception of Gateway credentials (auth.token and auth.password) transmitted during the connection handshake. The confidentiality impact is high, while integrity and availability are unaffected. Practical exposure is currently limited to developers and testers running alpha iOS and Android builds (not publicly available on the App Store or Play Store), though any shipped client relying on LAN discovery on an untrusted network is also at risk (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of publication. The EPSS score is approximately 0.004% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to be on the same local network segment as the victim and to advertise a rogue _openclaw-gw._tcp mDNS service (GitHub Advisory).

1. Reconnaissance: Identify a shared or untrusted LAN where OpenClaw clients (iOS, macOS, or Android alpha builds prior to v2026.2.14) are active. Use network scanning tools (e.g., avahi-browse, dns-sd, or Bonjour Browser) to observe existing _openclaw-gw._tcp mDNS service advertisements.
2. Set up rogue gateway: Deploy an attacker-controlled server (e.g., a simple HTTPS server with a self-signed certificate) on the local network to act as a fake OpenClaw gateway.
3. Advertise rogue mDNS service: Use a tool such as avahi-publish or a custom mDNS responder to broadcast a _openclaw-gw._tcp service with crafted TXT records, setting lanHost/tailnetDns to the attacker's server IP, gatewayPort to the attacker's listening port, and gatewayTlsSha256 to the fingerprint of the attacker's certificate.
4. Client connects to rogue endpoint: A vulnerable OpenClaw client discovers the rogue service and, trusting the unauthenticated TXT records, builds its connection URL using the attacker-supplied host and port. If the client has no stored TLS pin, it may accept the attacker's certificate (TOFU); if it has a stored pin, the TXT-provided fingerprint could override it on vulnerable iOS/Android builds.
5. Credential exfiltration: The client transmits its Gateway credentials (auth.token / auth.password) to the attacker's endpoint during the connection process, which the attacker captures (GitHub Advisory, Fix Commit).

• Network: Unexpected mDNS/Bonjour advertisements of _openclaw-gw._tcp services on the local network from unknown or unauthorized hosts; OpenClaw client connections to IP addresses not matching the legitimate gateway server.
• Network: TLS handshakes from OpenClaw clients to endpoints presenting certificates with unexpected fingerprints (not matching the stored/expected gatewayTlsSha256).
• Logs: OpenClaw client logs showing connection attempts to unexpected hosts or ports derived from mDNS TXT records (lanHost, tailnetDns, gatewayPort) rather than the configured gateway.
• Logs: Authentication events (token/password submission) to gateway endpoints not matching the legitimate server address.
• Process/Behavior: OpenClaw clients silently accepting new TLS certificates without user confirmation on iOS or Android alpha builds (GitHub Advisory).

The primary remediation is to upgrade OpenClaw to version 2026.2.14 or later, which hardens the discovery mechanism: clients now prefer resolved service endpoints (SRV + A/AAAA records) over TXT-provided routing hints, discovery-provided fingerprints no longer override stored TLS pins, first-time TLS pins on iOS/Android require explicit user confirmation with fingerprint display (no silent TOFU), discovery-based direct connections on iOS/Android are TLS-only, and Android no longer globally disables hostname verification. As an interim workaround, avoid running vulnerable OpenClaw versions on shared or untrusted LANs, and restrict deployment to isolated, trusted network segments (GitHub Advisory, Release v2026.2.14).

Coverage of CVE-2026-26327 has been modest, primarily appearing in vulnerability digest aggregators and security news sites. A Stackademic blog post grouped it with related OpenClaw CVEs (CVE-2026-26323 and CVE-2026-26317) as part of a broader 2026 OpenClaw vulnerability cluster. BeyondMachines noted that over 60 security vulnerabilities were resolved in the OpenClaw AI assistant around this release. The fix was credited to reporter @simecek, and the patch was part of a large v2026.2.14 security release addressing numerous issues across the platform (BeyondMachines, Release v2026.2.14).