N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-83f3-hh45-vfw9

GHSA-83f3-hh45-vfw9: OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

Summary

Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext ws:// gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.

Impact

A user who followed a forged discovery result or scanned a crafted setup code could disclose stored gateway credentials to an attacker-controlled endpoint in plaintext. This was a transport-security bug in the Android gateway client.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

a941a4fef9bc43b2973c92d0dcff5b8a426210c5 — require TLS for remote Android gateway endpoints

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @zsxsoft for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-83f3-hh45-vfw9

GHSA-83f3-hh45-vfw9:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Android client of OpenClaw, where the application failed to enforce TLS encryption for gateway connections to remote, non-loopback addresses. This allowed for the transmission of sensitive credentials in cleartext over unencrypted ws:// connections. The root cause was a lack of proper validation in multiple functions responsible for parsing, configuring, and establishing these connections. An attacker could exploit this by tricking a user into connecting to a malicious gateway via a crafted discovery beacon or setup code, leading to credential disclosure.

The patch addresses this by introducing a robust check, isLoopbackGatewayHost, to differentiate between local and remote endpoints. This check is now used throughout the connection process to enforce a strict security policy: all non-loopback connections must use TLS (wss://). The key modified functions, ConnectionManager.resolveTlsParamsForEndpoint and GatewayConfigResolver.parseGatewayEndpoint, now reject or upgrade connections to enforce this policy, effectively closing the transport-security gap.

Vulnerable functions

ai.openclaw.app.node.ConnectionManager.resolveTlsParamsForEndpoint

apps/android/app/src/main/java/ai/openclaw/app/node/ConnectionManager.kt

This function determines the TLS parameters for a gateway connection. Before the patch, it did not enforce TLS for non-loopback connections, allowing them to be established in cleartext. The patch adds a check using `isLoopbackGatewayHost` and forces TLS for all non-loopback endpoints.

ai.openclaw.app.ui.GatewayConfigResolver.parseGatewayEndpoint

apps/android/app/src/main/java/ai/openclaw/app/ui/GatewayConfigResolver.kt

This function parses a gateway endpoint URL. The vulnerability lies in its acceptance of `ws://` (non-TLS) schemes for remote, non-loopback hosts. The patch introduces a check to reject such configurations, returning null if a non-loopback host is paired with a non-TLS scheme.

ai.openclaw.app.gateway.GatewaySession.connect

apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewaySession.kt

This function is responsible for establishing the WebSocket connection. Before the patch, it would construct a `ws://` URL for any connection where TLS was not explicitly configured, regardless of whether the host was a remote or loopback address. This allowed credentials to be sent over an unencrypted channel.

ai.openclaw.app.NodeRuntime.connect

apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt

This function initiates the connection to the gateway. The pre-patch version of this function and its overloads did not enforce TLS for remote endpoints, proceeding to connect with whatever parameters were provided. The refactoring to `beginConnect` centralizes the connection logic and ensures that `connectionManager.resolveTlsParams` is called to enforce the new TLS policy.

ai.openclaw.app.ui.GatewayConfigResolver.resolveScannedSetupCode

apps/android/app/src/main/java/ai/openclaw/app/ui/GatewayConfigResolver.kt

This function resolves a setup code scanned by the user. It was vulnerable because it did not validate the security of the URL within the setup code. An attacker could craft a setup code with a `ws://` URL to a remote server. The patch adds a call to the now-secure `parseGatewayEndpoint` function to validate the URL.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.