CVE-2026-40045: OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://
(updated )
Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext ws:// gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.
References
- github.com/advisories/GHSA-83f3-hh45-vfw9
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/a941a4fef9bc43b2973c92d0dcff5b8a426210c5
- github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9
- nvd.nist.gov/vuln/detail/CVE-2026-40045
- www.vulncheck.com/advisories/openclaw-cleartext-credential-transmission-via-unencrypted-websocket-gateway-endpoints
Code Behaviors & Features
Detect and mitigate CVE-2026-40045 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →