Listen to this Post
The vulnerability (no assigned CVE in the ) allows an authenticated gateway client with config read access to retrieve unredacted secrets. The `config.get` function redacts sensitive fields (e.g., API keys, auth material, channel credentials) when returning the `resolved` or `config` objects. However, two alias fields – `sourceConfig` and `runtimeConfig` – were not redacted. These aliases survived the redaction process because the fix only applied to the primary configuration paths. An attacker could read these aliases to obtain plaintext secrets. The root cause is that the redaction logic did not explicitly overwrite `sourceConfig` and `runtimeConfig` with the redacted copies. The patch (commit 86734ef93a2f25063371b04f1946eb300548acd4, PR 66030) now forces both alias fields to be replaced by the same redacted copies used for `resolved` and config, including the invalid‑snapshot branch. Tests were added to cover both alias fields. The issue affects openclaw versions below 2026.4.14; version 2026.4.14 and later contain the fix.
dailycve form:
Platform: npm
Version: < 2026.4.14
Vulnerability: Redaction bypass
Severity: Medium
date: 2026-04-17
Prediction: 2026-04-14 (already patched)
What Undercode Say:
Check installed openclaw version
npm list openclaw
Simulate redaction bypass (pre-patch)
Attacker with config read access queries sourceConfig
curl -X GET -H "Authorization: Bearer $TOKEN" https://gateway/api/config?field=sourceConfig
Post-patch verification: ensure sourceConfig matches redacted config
node -e "const cfg = require('openclaw').config.get(); console.log(cfg.sourceConfig === cfg.resolved);"
Exploit:
Authenticated gateway client sends a request to `config.get` but accesses `sourceConfig` or `runtimeConfig` instead of resolved/config. The server returns unredacted secrets because those alias fields were not overwritten.
Protection from this CVE:
Upgrade to openclaw >= 2026.4.14. If unable to upgrade, manually patch by overwriting `sourceConfig` and `runtimeConfig` with redacted copies in the gateway configuration handler.
Impact:
Exposure of provider API keys, gateway authentication material, and channel credentials. An attacker can use these secrets to impersonate the gateway, access backend services, or compromise communication channels.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
