7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43528

CVE-2026-43528: OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43528

CVE-2026-43528:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.14	2026.4.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the redactConfigSnapshot function located in src/config/redact-snapshot.ts. This function is designed to remove sensitive information from configuration snapshots before they are exposed to clients. The analysis of the patch 86734ef93a2f25063371b04f1946eb300548acd4 reveals that the function failed to process the sourceConfig and runtimeConfig fields, which are aliases for the configuration. Consequently, these fields were returned unredacted, leaking potentially sensitive data. The fix applied in the commit involves explicitly setting sourceConfig and runtimeConfig to the redacted versions of the configuration, thus closing the information leak. Any runtime profile capturing the execution path during the exploitation of this vulnerability would show calls to the redactConfigSnapshot function.

Vulnerable functions

redactConfigSnapshot

src/config/redact-snapshot.ts

The function `redactConfigSnapshot` was vulnerable because it did not redact the `sourceConfig` and `runtimeConfig` fields from the configuration snapshot. These fields were aliases and could contain sensitive information like API keys and credentials. An authenticated user with config read access could retrieve these unredacted secrets. The patch fixes this by explicitly overwriting `sourceConfig` and `runtimeConfig` with the redacted configuration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.