CVE-2026-41335CWE-497

OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON

Medium · published April 23, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and agent configurations.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00410 · 34.1th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-04-23T21:57Z
EPSS history
Timeline
  • 23 APR 21:57Z
    OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON
    cvelistv5