Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseGHSA-3cvx-236h-m9fj
GHSA-3cvx-236h-m9fj:
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation
Description
In affected releases, when an operator explicitly enabled gateway.controlUi.allowInsecureAuth: true and exposed the gateway over plaintext HTTP, Control UI authentication could permit privileged operator access without the intended device identity + pairing guarantees.
This required an insecure deployment choice and credential exposure risk (for example, plaintext transit or prior token leak). It was fixed on main in commit 40a292619e1f2be3a3b1db663d7494c9c2dc0abf (PR #20684).
Affected Packages / Versions
- Package:
openclaw(npm) - Affected published versions:
<= 2026.2.19-2 - Planned patched version:
2026.2.21
Impact
In these explicitly insecure deployments, an attacker with leaked/intercepted credentials could obtain high-privilege Control UI access.
Fix Commit(s)
40a292619e1f2be3a3b1db663d7494c9c2dc0abf(merged 2026-02-20) OpenClaw thanks @Vasco0x4 for reporting.
Source: NVD
Related OpenClaw (formerly Moltbot or Clawdbot) vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management