MEDIUM
OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON
Published Apr 23, 2026
6.9
MEDIUMCVSS 4.0
EPSS 0.41%
Description
OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and agent configurations.
Affected products
-
- Version 0StatusaffectedConstraints<2026.3.31
- Version 2026.3.31StatusunaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
openclaw
npm
Introduced 0 Fixed 2026.3.31
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | openclaw | 0 | 2026.3.31 |
Remediation
No remediation recorded yet.
Weaknesses (2)
References (6)
- https://github.com/advisories/GHSA-hr8g-2q7x-3f4w Advisory
- https://github.com/openclaw/openclaw/commit/c5c10adc022f42eb75ebb3bf364dd607738683b3 patch
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
- https://github.com/openclaw/openclaw/security/advisories/GHSA-hr8g-2q7x-3f4w vendor-advisoryVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41335
- https://www.vulncheck.com/advisories/openclaw-information-disclosure-via-control-ui-bootstrap-json third-party-advisoryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/advisories/GHSA-hr8g-2q7x-3f4w | Advisory | |
| https://github.com/openclaw/openclaw/commit/c5c10adc022f42eb75ebb3bf364dd607738683b3 | patch | |
| https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 | ||
| https://github.com/openclaw/openclaw/security/advisories/GHSA-hr8g-2q7x-3f4w | vendor-advisoryVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-41335 | ||
| https://www.vulncheck.com/advisories/openclaw-information-disclosure-via-control-ui-bootstrap-json | third-party-advisoryThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Apr 23, 2026
Updated Apr 25, 2026
Reserved Apr 20, 2026
Link CVE-2026-41335
CISA Vulnrichment
GHSA-HR8G-2Q7X-3F4W Updated Apr 25, 2026