Vulnerability DatabaseCVE-2026-40045
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-40045
Published:April 20, 2026
Updated:April 23, 2026
OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials.
Affected Packages
https://github.com/openclaw/openclaw.git (GITHUB):
Affected version(s) >=v0.1.0 <v2026.4.2
Fix Suggestion:
Update to version v2026.4.2
openclaw (NPM):
Affected version(s) >=0.0.1 <2026.4.2
Fix Suggestion:
Update to version 2026.4.2
openclaw (NPM):
Affected version(s) >=0.0.1 <2026.4.2
Fix Suggestion:
Update to version 2026.4.2
Related Resources (4)
https://www.vulncheck.com/advisories/openclaw-cleartext-credential-transmission-via-unencrypted-websocket-gateway-endpoints
https://github.com/openclaw/openclaw/commit/a941a4fef9bc43b2973c92d0dcff5b8a426210c5
https://github.com/openclaw/openclaw
https://github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.9
Attack Vector
ADJACENT
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.7
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
Cleartext Transmission of Sensitive Information
CWE-319
EPSS
Base Score:
0.01