CVE-2026-43528 in OpenClaw
Summary
by MITRE • 05/05/2026
OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/08/2026
This vulnerability exists within the OpenClaw gateway system prior to version 2026.4.14 where a redaction bypass mechanism fails to properly sanitize sensitive configuration data. The flaw specifically affects the sourceConfig and runtimeConfig alias fields which contain alias references that should be automatically redacted during data retrieval operations. When authenticated gateway clients request configuration data containing these aliased references, the system fails to apply proper redaction filters, allowing attackers with configuration read privileges to extract unredacted secrets that should have been obscured.
The technical implementation of this vulnerability stems from insufficient input validation and output sanitization within the configuration retrieval pipeline. The system correctly identifies sensitive fields for redaction but fails to account for alias references that point to these sensitive areas. This creates a path where attackers can traverse through aliased configuration references to access underlying secrets without proper authorization. The vulnerability represents a classic case of improper information flow control where redaction rules are not consistently applied across all data access paths.
Operational impact of this vulnerability is significant for organizations relying on OpenClaw for API gateway management and cloud service integration. Attackers with minimal configuration read access can extract provider API keys, gateway authentication tokens, and channel credentials that would normally be protected through standard redaction processes. This compromise undermines the fundamental security assumptions of the system's configuration management and can lead to unauthorized access to downstream services, data exfiltration, and potential lateral movement within the network infrastructure. The vulnerability affects any environment where OpenClaw is used as a gateway solution and where configuration access permissions are not properly restricted.
The security implications align with CWE-20: Improper Input Validation and CWE-532: Information Exposure Through Log Data, as the system fails to properly validate input and fails to properly redact sensitive information during output processing. This vulnerability can be mapped to ATT&CK technique T1566.002: Phishing via Service Provider, as attackers could potentially use the extracted credentials to conduct further attacks. The most effective mitigations include implementing comprehensive redaction rules that account for alias references, enforcing principle of least privilege for configuration access, and deploying automated monitoring systems to detect unusual configuration data access patterns. Organizations should also consider implementing additional authentication layers for sensitive configuration data and establishing regular security audits of configuration management systems. The vendor has addressed this issue in version 2026.4.14 through enhanced redaction logic and improved alias resolution mechanisms that ensure all sensitive data is properly sanitized regardless of access path.