CVE-2026-44994CWE-862

OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint

Medium · published May 11, 2026

CVSS v4.0
6.3
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sensitive configuration fields. Attackers can access the bootstrap config route without a valid Gateway token to expose sensitive bootstrap and config information intended only for authenticated Control UI sessions.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00557 · 45.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-11T16:46Z
EPSS history
Timeline
  • 11 MAY 16:46Z
    OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint
    cvelistv5