Every CVE Search/ Get API key

CVE-2026-43528

OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases

7.1 HighFix available

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.33%Up 0.3 points since May 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.

Record
CVE-2026-43528
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-212
Updated
2026-11-02
EUVDEUVD-2026-27267 7.1

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.

Record
EUVD-2026-27267
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8372-7vhw-cm6q 7.1

OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

Summary

config.get redaction bypass through sourceConfig and runtimeConfig aliases.

Affected Packages / Versions

  • Package: openclaw
  • Ecosystem: npm
  • Affected versions: < 2026.4.14
  • Patched versions: >= 2026.4.14

Impact

An authenticated gateway client with config read access could receive unredacted secrets through alias fields that survived redaction, including provider API keys, gateway auth material, and channel credentials.

Technical Details

The fix explicitly overwrites sourceConfig and runtimeConfig with the same redacted copies used for resolved and config, including the invalid-snapshot branch. Tests now cover both alias fields.

Fix

The issue was fixed in #66030. The first stable tag containing the fix is v2026.4.14, and [email protected] includes the fix.

Fix Commit(s)

  • 86734ef93a2f25063371b04f1946eb300548acd4
  • PR: #66030

Release Process Note

Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Record
GHSA-8372-7vhw-cm6q
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-212
Updated
2026-11-02
NVD 7.1

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.

Record
CVE-2026-43528
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-212
Updated
2026-11-02
OSV 7.1

OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.

Record
CVE-2026-43528
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-212
Updated
2026-11-02
OSVGHSA-8372-7vhw-cm6q 7.1

OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

Summary

config.get redaction bypass through sourceConfig and runtimeConfig aliases.

Affected Packages / Versions

  • Package: openclaw
  • Ecosystem: npm
  • Affected versions: < 2026.4.14
  • Patched versions: >= 2026.4.14

Impact

An authenticated gateway client with config read access could receive unredacted secrets through alias fields that survived redaction, including provider API keys, gateway auth material, and channel credentials.

Technical Details

The fix explicitly overwrites sourceConfig and runtimeConfig with the same redacted copies used for resolved and config, including the invalid-snapshot branch. Tests now cover both alias fields.

Fix

The issue was fixed in #66030. The first stable tag containing the fix is v2026.4.14, and [email protected] includes the fix.

Fix Commit(s)

  • 86734ef93a2f25063371b04f1946eb300548acd4
  • PR: #66030

Release Process Note

Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Record
GHSA-8372-7vhw-cm6q
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-212
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 before 2026.4.14
2026.4.14

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-43528 is a high vulnerability (CVSS 7.1) in Openclaw, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in openclaw 2026.4.14.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open