7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rchv-x836-w7xp

GHSA-rchv-x836-w7xp: OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

OpenClaw's macOS Dashboard flow exposed Gateway authentication material to browser-controlled surfaces.

Before the fix, the macOS app appended the shared Gateway token and password to the Dashboard URL query string when opening the Control UI in the browser. The Control UI then imported the token and persisted it into browser localStorage under openclaw.control.settings.v1.

This expanded exposure of reusable Gateway admin credentials into browser address-bar/query surfaces and persistent script-readable storage.

Affected Packages / Versions

Package: openclaw (npm)
Latest published version verified vulnerable: 2026.3.2
Affected range: <= 2026.3.2
Patched version: >= 2026.3.7

Impact

An attacker with access to browser-controlled surfaces or persistent browser storage could recover a valid Gateway admin token and reuse it against the OpenClaw management interface.

The exposure chain was:

macOS Open Dashboard constructed a URL with auth material.
The browser received that credential-bearing URL.
The Control UI imported the token from the URL.
The Control UI persisted the token in localStorage.

Fix

The fix aligns the macOS Dashboard flow with the safer existing CLI/bootstrap pattern and removes persistent browser token storage:

macOS Dashboard now passes the Gateway token via URL fragment instead of query parameters.
macOS Dashboard no longer propagates the shared Gateway password into browser URLs.
Control UI keeps Gateway tokens in memory only for the current tab.
Control UI scrubs legacy persisted tokens from openclaw.control.settings.v1 on load.
Regression tests cover fragment transport, password omission, and token-scrubbing behavior.

Miggo Vulnerability Database

→

GHSA-rchv-x836-w7xp

GHSA-rchv-x836-w7xp:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.2	2026.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from two main issues in the OpenClaw dashboard. First, the macOS application, when opening the dashboard, constructed a URL that included the gateway authentication token and password as query parameters. The function GatewayEndpointStore.dashboardURL in apps/macos/Sources/OpenClaw/GatewayEndpointStore.swift was responsible for this insecure URL construction. This exposed sensitive credentials in the browser's address bar, history, and potentially in logs.

Second, the web-based Control UI would then take these credentials from the URL and persist the token in the browser's localStorage. The saveSettings function in ui/src/ui/storage.ts directly serialized the settings object, which contained the token, into localStorage. The loadSettings function would then load this token back into the application on subsequent visits. This created a persistent exposure of the admin token in script-readable storage, accessible to any malicious script that could achieve execution on the dashboard's origin.

The patch addresses these issues by:

Modifying GatewayEndpointStore.dashboardURL to pass the token via the URL fragment (#) instead of the query string, and completely removing the password from the URL.
Changing saveSettings and loadSettings in ui/src/ui/storage.ts to ensure the token is never persisted to localStorage and that any legacy tokens are scrubbed upon loading the application.

Vulnerable functions

GatewayEndpointStore.dashboardURL

apps/macos/Sources/OpenClaw/GatewayEndpointStore.swift

The function constructed a URL with the gateway token and password in the query string. This exposed the credentials in the browser's URL, history, and potentially server logs.

saveSettings

ui/src/ui/storage.ts

This function was responsible for persisting the UI settings, including the sensitive gateway token, into the browser's `localStorage`. This made the token accessible to any script running on the same origin.

loadSettings

ui/src/ui/storage.ts

This function loaded settings from `localStorage` into the application. Before the fix, it would load the persisted gateway token, making it available in the application's memory. The fix ensures that any legacy token from `localStorage` is scrubbed on load.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.1

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-rchv-x836-w7xp: OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

Affected Packages / Versions

Impact

Fix

GHSA-rchv-x836-w7xp:

7.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

7.1

7.1

Technical Details

GHSA-rchv-x836-w7xp: OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

Affected Packages / Versions

Impact

Fix

Basic Information

Basic Information

Fix Commit(s)

Release Process Note

7.1

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-rchv-x836-w7xp: OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

Affected Packages / Versions

Impact

Fix

GHSA-rchv-x836-w7xp:

7.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

7.1

7.1

Technical Details

GHSA-rchv-x836-w7xp: OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

Affected Packages / Versions

Impact

Fix

Basic Information

Basic Information

Fix Commit(s)

Release Process Note

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI