CVE-2026-100543: OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as offline password verifiers: a caller able to obtain the redacted configuration (for example via config.get) could test password candidates offline without going through the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Secret references were not affected in the same way. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are realistically at risk?
Deployments are at risk when an attacker can obtain a redacted configuration response, the Gateway password has low entropy, and the remaining configuration values can be reconstructed. Secret references are not affected in the same way.
What access does an attacker need to exploit this issue?
An attacker needs access to a redacted configuration response, for example through config.get. They can then test Gateway password candidates offline rather than using the rate-limited Gateway authentication path.
What is the impact if the Gateway password is recovered?
Recovering the password could grant the documented shared-secret operator authority. The issue affects confidentiality, integrity, and availability according to the supplied severity vector.
What version fixes the issue?
The issue is fixed in OpenClaw version 2026.8.1. Versions before 2026.8.1 are affected.