Disclosed weakness · no CVE recorded

OpenClaw could send a model provider’s request and credential to a different provider

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

An OpenClaw user reported an OpenRouter check reaching TypeSafe. Maintainers subsequently restricted where provider plugins could redirect other providers’ requests.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The October reporter documented misrouting. The sources do not establish deliberate exploitation or credential misuse.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Provider transport customization could replace another provider’s destination while retaining the original request credentials.

Conditions required

An affected gateway loads multiple provider plugins and uses plugin-controlled transport settings.

Potential impact

A model request and its credential could reach a service outside the configured provider account.

Affected versions and configurations

The original reporter identified OpenClaw 2026.10.7. The full affected range is unverified.

Fix and mitigation status

OpenClaw 2026.11.3 includes the correction. An earlier fixed build may exist.

Practical next steps

Install a build containing the transport restriction. Where provider traffic reached an unexpected service, review request logs and replace the affected credentials.

Operating lesson

Bind the provider’s credentials to its approved destination throughout request processing.

Evidence and limits

The October 27 report and provider-specific correction preceded the October 31 shared fix. A different September advisory concerned a model reload and an SDK default destination.

Sources