https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T09:35:51.961985+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-40045 CVE-2026-40045 — OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints 2026-09-29T09:35:51.964218+00:00

Affected: OpenClaw

OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials.

 https://db.gcve.eu/vuln/ghsa-83f3-hh45-vfw9 GHSA-83f3-hh45-vfw9 — OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws:// 2026-09-29T09:35:51.964282+00:00

Affected: npm: openclaw

## Summary

Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext `ws://` gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.

## Impact

A user who followed a forged discovery result or scanned a crafted setup code could disclose stored gateway credentials to an attacker-controlled endpoint in plaintext. This was a transport-security bug in the Android gateway client.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected versions: `<= 2026.4.1` - Patched versions: `>= 2026.4.2` - Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `a941a4fef9bc43b2973c92d0dcff5b8a426210c5` — require TLS for remote Android gateway endpoints

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @zsxsoft for reporting.