Disclosed weakness · no CVE recorded

OpenClaw workspace transfers could trust an unverified peer

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

Workspace transfers could proceed without establishing that the remote endpoint was trusted.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documents the defect and its correction. The reviewed sources identify no malicious use or victim.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The transfer client could omit both configured certificate-pin verification and ordinary certificate-chain verification.

Conditions required

A worker exchanges workspace data with a gateway under an affected TLS configuration.

Potential impact

Workspace data and credentials sent during a transfer could reach an unintended recipient.

Affected versions and configurations

The project identifies the affected behavior. Its full version range is unverified.

Fix and mitigation status

OpenClaw 2026.11.3 includes the correction. An earlier fixed build may exist.

Practical next steps

Use a build containing the transfer fix and validate the gateway identity in worker transfer configurations.

Operating lesson

Check the recipient’s identity before sending credentials or workspace data.

Evidence and limits

The original public project discussion predates the November stable release. The reviewed sources give no CVE identity or CVSS score for this defect.

Sources