CVE-2026-35644: OpenClaw credential exposure

CISO Take

OpenClaw before 2026.3.22 stores authentication credentials in plaintext inside channel baseUrl and httpUrl fields, which are fully readable through the config.get and channels.status API endpoints by any account holding operator.read scope — a low-privilege role. Although severity is rated Medium (CVSS 6.5), the EPSS score places this in the top 91st percentile for exploitation likelihood, meaning automated scanners or threat actors are highly likely to target it. The blast radius is currently limited to 4 downstream dependents, no public exploit exists, and CISA has not added it to KEV; however, the credential exposure directly enables lateral movement into whatever external services OpenClaw channels connect to, which in AI agent deployments typically includes LLM APIs, data stores, and orchestration backends. Immediate action: upgrade to 2026.3.22 or later; if patching is not yet possible, revoke or rotate all credentials stored in channel URL fields and audit operator.read role assignments to reduce the attack surface.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Net risk is moderate-to-high for organizations running OpenClaw as an AI agent gateway. The CVSS 6.5 score undersells operational impact: leaked credentials embedded in channel URLs can grant access to upstream LLM APIs, databases, or internal services far beyond OpenClaw itself, turning a medium-severity information-disclosure into a stepping stone for high-impact lateral movement. EPSS top-91% indicates automated exploitation is plausible even without a public PoC. The low privilege required (operator.read) and no user interaction needed make opportunistic exploitation trivial once network access exists.

How does the attack unfold?

Credential Acquisition

Attacker obtains a low-privilege operator.read token through credential theft, RBAC misconfiguration, or insider access.

AML.T0012

Configuration Discovery

Attacker queries the config.get and channels.status endpoints of the OpenClaw instance using the operator.read token to enumerate channel configurations.

AML.T0084

Credential Extraction

Response payloads contain baseUrl and httpUrl fields with authentication credentials embedded in plaintext URL userinfo components; attacker parses and harvests these secrets.

AML.T0083

Lateral Movement / Impact

Harvested credentials are used to directly access upstream LLM APIs, databases, or internal services, enabling data exfiltration, unauthorized inference, or further compromise of the AI agent ecosystem.

AML.T0025

Credential Acquisition

Attacker obtains a low-privilege operator.read token through credential theft, RBAC misconfiguration, or insider access.

AML.T0012

Configuration Discovery

Attacker queries the config.get and channels.status endpoints of the OpenClaw instance using the operator.read token to enumerate channel configurations.

AML.T0084

Credential Extraction

Response payloads contain baseUrl and httpUrl fields with authentication credentials embedded in plaintext URL userinfo components; attacker parses and harvests these secrets.

AML.T0083

Lateral Movement / Impact

Harvested credentials are used to directly access upstream LLM APIs, databases, or internal services, enabling data exfiltration, unauthorized inference, or further compromise of the AI agent ecosystem.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: upgrade OpenClaw to version 2026.3.22 or later (patches committed at 630f147 and f020226).
Rotate immediately: revoke and reissue all credentials that were ever stored in channel baseUrl or httpUrl fields — assume they are compromised.
Audit scope: identify all principals holding operator.read scope and remove assignments that are not strictly necessary.
Detect: review OpenClaw access logs for unusual GET requests to config.get or channels.status endpoints, especially from IP addresses or service accounts not normally accessing configuration APIs.
Structural fix: migrate to credential injection via environment variables or a secrets manager rather than embedding auth in URLs — enforce this as a deployment policy going forward.

How is it classified?

Data Extraction Auth Bypass Data Leakage Agent API Framework AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.9.4 - Access control to AI systems

NIST AI RMF

GOVERN 1.6 - Policies and procedures are in place for AI risk management

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35644?

OpenClaw before 2026.3.22 stores authentication credentials in plaintext inside channel baseUrl and httpUrl fields, which are fully readable through the config.get and channels.status API endpoints by any account holding operator.read scope — a low-privilege role. Although severity is rated Medium (CVSS 6.5), the EPSS score places this in the top 91st percentile for exploitation likelihood, meaning automated scanners or threat actors are highly likely to target it. The blast radius is currently limited to 4 downstream dependents, no public exploit exists, and CISA has not added it to KEV; however, the credential exposure directly enables lateral movement into whatever external services OpenClaw channels connect to, which in AI agent deployments typically includes LLM APIs, data stores, and orchestration backends. Immediate action: upgrade to 2026.3.22 or later; if patching is not yet possible, revoke or rotate all credentials stored in channel URL fields and audit operator.read role assignments to reduce the attack surface.

Is CVE-2026-35644 actively exploited?

No confirmed active exploitation of CVE-2026-35644 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35644?

1. Patch: upgrade OpenClaw to version 2026.3.22 or later (patches committed at 630f147 and f020226). 2. Rotate immediately: revoke and reissue all credentials that were ever stored in channel baseUrl or httpUrl fields — assume they are compromised. 3. Audit scope: identify all principals holding operator.read scope and remove assignments that are not strictly necessary. 4. Detect: review OpenClaw access logs for unusual GET requests to config.get or channels.status endpoints, especially from IP addresses or service accounts not normally accessing configuration APIs. 5. Structural fix: migrate to credential injection via environment variables or a secrets manager rather than embedding auth in URLs — enforce this as a deployment policy going forward.

What systems are affected by CVE-2026-35644?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, LLM orchestration gateways, Multi-channel agent deployments, API proxy/gateway layers for AI services.

What is the CVSS score for CVE-2026-35644?

CVE-2026-35644 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksLLM orchestration gatewaysMulti-channel agent deploymentsAPI proxy/gateway layers for AI services

MITRE ATLAS Techniques

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.9.4

NIST AI RMF: GOVERN 1.6

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication information from URL userinfo components.

Exploitation Scenario

An attacker who has obtained an operator.read token — through phishing a junior DevOps engineer, exploiting a misconfigured RBAC policy, or purchasing leaked credentials — issues a GET to the channels.status or config.get endpoint of an internet-exposed OpenClaw instance. The response returns channel configurations including baseUrl and httpUrl fields with credentials embedded in the userinfo component (e.g., https://apikey:secret@llm-gateway.internal/v1). The attacker extracts LLM provider API keys, database passwords, or internal service tokens from these URLs and uses them to directly query the upstream AI services, exfiltrate training data or inference history, or pivot deeper into the organization's AI infrastructure without ever touching OpenClaw again.

Weaknesses (CWE)

CWE-312 Cleartext Storage of Sensitive Information

CWE-312 — Cleartext Storage of Sensitive Information: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

[Implementation, System Configuration, Operation] When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
[Implementation, System Configuration, Operation] In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Source: MITRE CWE corpus.