CVE-2026-43528: OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

April 17, 2026 (updated May 5, 2026)

config.get redaction bypass through sourceConfig and runtimeConfig aliases.

References

github.com/advisories/GHSA-8372-7vhw-cm6q
github.com/openclaw/openclaw/commit/86734ef93a2f25063371b04f1946eb300548acd4
github.com/openclaw/openclaw/pull/66030
github.com/openclaw/openclaw/security/advisories/GHSA-8372-7vhw-cm6q
nvd.nist.gov/vuln/detail/CVE-2026-43528

Code Behaviors & Features

Detect and mitigate CVE-2026-43528 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →