Disclosed weakness · no CVE recorded

OpenClaw could disregard a node’s saved gateway certificate pin

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

A node could connect without enforcing the gateway identity its operator had previously pinned.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documents the defect and its correction. The reviewed sources identify no malicious use or victim.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The node client’s connection settings could replace an existing certificate pin with an empty value.

Conditions required

The node relies on a saved certificate pin to identify its gateway.

Potential impact

A connection could lose the extra identity assurance provided by the stored pin.

Affected versions and configurations

The project identifies the affected behavior. Its full version range is unverified.

Fix and mitigation status

The project lists the fix in 2026.11.3 and in its gateway-only extended-stable 2026.9.37 notes. Applicability of that maintenance line depends on the deployed component.

Practical next steps

Use a release containing the node fix and confirm that existing nodes retain the expected gateway certificate identity.

Operating lesson

Treat a stored certificate pin as an explicit trust decision when combining connection settings.

Evidence and limits

The August 18 node-client change concerns a saved certificate pin. A separate worker-transfer report concerns peer verification during data transfer.

Sources