GHSA-83f3-hh45-vfw9: OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

April 7, 2026

Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext ws:// gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.

References

github.com/advisories/GHSA-83f3-hh45-vfw9
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/a941a4fef9bc43b2973c92d0dcff5b8a426210c5
github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9

Code Behaviors & Features

Detect and mitigate GHSA-83f3-hh45-vfw9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →