Summary
OpenClaw's Gateway Control UI bootstrap config required Gateway auth
Gateway Control UI bootstrap config required Gateway auth.
Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22
Fix Commit(s)
- 2321d67263bc710e357644d59f746b08d891051b
Verification
- The fix commit is contained in the public v2026.4.22 tag.
- [email protected] is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.
OpenClaw thanks @zsxsoft for reporting.
Impact
When Gateway authentication was enabled, the Control UI bootstrap config endpoint could still be read without a valid Gateway token. That response could expose sensitive bootstrap/config fields intended only for authenticated Control UI sessions.
The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The bootstrap config route now goes through the same Gateway read-auth path as other authenticated Control UI reads. Regression tests cover unauthenticated rejection, valid-token access, and basePath handling.
Frequently Asked Questions
- What is GHSA-93RG-2XM5-2P9V? GHSA-93RG-2XM5-2P9V is a medium-severity improper authentication vulnerability in openclaw (npm), affecting versions <= 2026.4.21. It is fixed in 2026.4.22. The application does not adequately verify the identity of a user, device, or process before granting access.
- Which versions of openclaw are affected by GHSA-93RG-2XM5-2P9V? openclaw (npm) versions <= 2026.4.21 is affected.
- Is there a fix for GHSA-93RG-2XM5-2P9V? Yes. GHSA-93RG-2XM5-2P9V is fixed in 2026.4.22. Upgrade to this version or later.
- Is GHSA-93RG-2XM5-2P9V exploitable, and should I be worried? Whether GHSA-93RG-2XM5-2P9V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-93RG-2XM5-2P9V is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-93RG-2XM5-2P9V? Upgrade
openclawto 2026.4.22 or later.