Disclosed weakness · no CVE recorded

OpenClaw configuration views could display inline environment secrets

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

A permitted configuration read could reveal stored environment credentials in the CLI or gateway response.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documents the defect and its correction. The reviewed sources identify no malicious use or victim.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Redaction depended on the field name and did not consistently cover inline environment values.

Conditions required

An installation stores credentials as inline environment settings, and a user or integration can read configuration output.

Potential impact

Configuration viewers or systems retaining their output could receive secrets unnecessary for that view.

Affected versions and configurations

The project identifies the affected behavior. Its full version range is unverified.

Fix and mitigation status

OpenClaw 2026.11.3 includes the correction. An earlier fixed build may exist.

Practical next steps

Update to a build with the redaction fix and review shared configuration output for credentials that require rotation.

Operating lesson

Protect values according to how they are stored and used, even when operators choose unfamiliar names.

Evidence and limits

This concerns CLI and gateway configuration reads. The previously indexed configuration-audit issue concerns secrets written to local history.

Sources