CVE-2026-40045: OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://
(updated )
Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext ws:// gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.
References
- github.com/advisories/GHSA-83f3-hh45-vfw9
- github.com/openclaw/openclaw/commit/a941a4fef9bc43b2973c92d0dcff5b8a426210c5
- github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9
- nvd.nist.gov/vuln/detail/CVE-2026-40045
- www.vulncheck.com/advisories/openclaw-cleartext-credential-transmission-via-unencrypted-websocket-gateway-endpoints
Code Behaviors & Features
Detect and mitigate CVE-2026-40045 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →