7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26327

CVE-2026-26327: OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning

OpenClaw is a personal AI assistant. Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such as lanHost, tailnetDns, gatewayPort, and gatewayTlsSha256. TXT records are unauthenticated. Prior to version 2026.2.14, some clients treated TXT values as authoritative routing/pinning inputs. iOS and macOS used TXT-provided host hints (lanHost/tailnetDns) and ports (gatewayPort) to build the connection URL. iOS and Android allowed the discovery-provided TLS fingerprint (gatewayTlsSha256) to override a previously stored TLS pin. On a shared/untrusted LAN, an attacker could advertise a rogue _openclaw-gw._tcp service. This could cause a client to connect to an attacker-controlled endpoint and/or accept an attacker certificate, potentially exfiltrating Gateway credentials (auth.token / auth.password) during connection. As of time of publication, the iOS and Android apps are alpha/not broadly shipped (no public App Store / Play Store release). Practical impact is primarily limited to developers/testers running those builds, plus any other shipped clients relying on discovery on a shared/untrusted LAN. Version 2026.2.14 fixes the issue. Clients now prefer the resolved service endpoint (SRV + A/AAAA) over TXT-provided routing hints. Discovery-provided fingerprints no longer override stored TLS pins. In iOS/Android, first-time TLS pins require explicit user confirmation (fingerprint shown; no silent TOFU) and discovery-based direct connects are TLS-only. In Android, hostname verification is no longer globally disabled (only bypassed when pinning).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26327

CVE-2026-26327:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the OpenClaw clients on multiple platforms (iOS, Android, macOS, and CLI) improperly trusted unauthenticated information from mDNS/Bonjour discovery TXT records. This allowed a local network attacker to perform two main actions:

Connection Steering: By advertising a rogue _openclaw-gw._tcp service, an attacker could provide malicious lanHost or tailnetDns values in the TXT record. Vulnerable clients would prioritize these hints for routing, causing them to connect to an attacker-controlled IP address instead of the legitimate gateway.
TLS Pinning Bypass: The discovery mechanism also included a gatewayTlsSha256 TXT record. Vulnerable clients would accept this fingerprint to pin the gateway's TLS certificate, even on the first connection (a flaw in Trust On First Use). This allowed an attacker to perform a man-in-the-middle (MITM) attack by presenting their own certificate and having the client trust it, potentially leading to the exfiltration of gateway credentials.

The analysis of the patch d583782ee322a6faa1fe87ae52455e0d349de586 reveals the vulnerable functions across the different client applications. The fix involves several key changes:

Prioritizing the resolved service endpoint (from SRV/A/AAAA records) for routing over hints from TXT records.
Preventing a discovery-provided TLS fingerprint from overriding a previously stored, trusted pin.
Requiring that auto-connections are only made to gateways that are already trusted (i.e., have a stored TLS pin).

The identified vulnerable functions are the specific entry points where this unauthenticated data was processed and used to establish connections, making them the critical points of failure during an exploit.

Vulnerable functions

ai.openclaw.android.node.ConnectionManager.resolveTlsParams

apps/android/app/src/main/java/ai/openclaw/android/node/ConnectionManager.kt

This function determined the TLS parameters for a gateway connection. The vulnerable version of this function trusted the `tlsFingerprintSha256` value provided in an unauthenticated mDNS TXT record. An attacker could advertise a rogue gateway with a malicious TLS fingerprint, causing the client to trust an attacker-controlled certificate, leading to a man-in-the-middle (MITM) attack.

GatewayConnectionController.resolveDiscoveredTLSParams

apps/ios/Sources/Gateway/GatewayConnectionController.swift

This function on iOS is analogous to `resolveTlsParams` on Android. It was vulnerable because it would use the `gateway.tlsFingerprintSha256` from an unauthenticated discovery broadcast as the expected fingerprint if no fingerprint was already stored. This allowed an attacker to bypass TLS certificate pinning on the first connection (TOFU - Trust On First Use) and intercept traffic.

GatewayConnectionController.resolveGatewayHost

apps/ios/Sources/Gateway/GatewayConnectionController.swift

This function was responsible for resolving the hostname for a discovered gateway. It prioritized the `tailnetDns` and `lanHost` values from the unauthenticated mDNS TXT record. An attacker on the same local network could advertise a rogue service with a malicious `lanHost`, redirecting the client to an attacker-controlled server. This function was removed as part of the fix.

pickBeaconHost

src/cli/gateway-cli/discover.ts

This function in the command-line interface (CLI) was used to determine the host to connect to from a discovered beacon. The vulnerable version prioritized the `tailnetDns` and `lanHost` values from the unauthenticated TXT record over the resolved service host. This could be exploited by a local attacker to steer the CLI's connection to a malicious endpoint.

GatewayConnectionController.maybeAutoConnect

apps/ios/Sources/Gateway/GatewayConnectionController.swift

This function handled automatic connections to discovered gateways. The vulnerability lay in its willingness to connect automatically without first verifying if the gateway was trusted. The fix introduces a check to ensure a TLS fingerprint is already stored for the gateway's stable ID, preventing automatic connections to new, potentially malicious gateways.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.