High
OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases
Type: advisorySources: OSV
OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-43528
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 18:13 UTC · Revision 1
Source evidence
OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases
core-osv · Original sourcePublished 5 May 2026, 11:24 UTC
OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.
osv:CVE-2026-43528
Complete source record
{
"id": "4825387c8f043e19b23377dda83bca2c5146472b25cd02390fea2bc2c233c632",
"url": "https://osv.dev/vulnerability/CVE-2026-43528",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases",
"summary": "OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.",
"evidence": "osv:CVE-2026-43528",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-43528",
"aliases": [
"CVE-2026-43528",
"GHSA-8372-7vhw-cm6q"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openclaw/openclaw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "323493fa1b6adc1e10b9954a68d5eaa5a6ef1170"
},
{
"fixed": "86734ef93a2f25063371b04f1946eb300548acd4"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.4.14"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "86734ef93a2f25063371b04f1946eb300548acd4"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2026.4.12",
"v2026.4.12-beta.1",
"v2026.4.11",
"v2026.4.11-beta.1",
"v2026.4.10",
"v2026.4.9",
"v2026.4.9-beta.1",
"v2026.4.8",
"v2026.4.7-1",
"v2026.4.7",
"v2026.4.5",
"v2026.4.2",
"v2026.4.1",
"v2026.4.1-beta.1",
"v2026.3.31",
"v2026.3.31-beta.1",
"v2026.3.28",
"v2026.3.28-beta.1",
"v2026.3.24",
"v2026.3.24-beta.2",
"v2026.3.24-beta.1",
"v2026.3.23-2",
"v2026.3.23",
"v2026.3.23-beta.1",
"v2026.3.22",
"v2026.3.22-beta.1",
"v2026.3.13-1",
"v2026.3.13",
"v2026.3.12",
"v2026.3.11",
"v2026.3.11-beta.1",
"v2026.3.8",
"v2026.3.8-beta.1",
"v2026.3.7",
"v2026.3.7-beta.1",
"v2026.3.2-beta.1",
"v2026.3.2",
"v2026.3.1",
"v2026.2.26",
"v2026.2.26-beta.1",
"v2026.2.25",
"v2026.2.25-beta.1",
"v2026.2.24",
"v2026.2.24-beta.1",
"v2026.2.23",
"v2026.2.23-beta.1",
"v2026.2.22",
"v2026.2.22-beta.1",
"v2026.2.21",
"v2026.2.21-beta.1",
"v2026.2.19-beta.1",
"v2026.2.19",
"v2026.2.17",
"v2026.2.15-beta.1",
"v2026.2.14",
"v2026.2.13",
"v2026.2.12",
"v2026.2.9",
"v2026.2.6-3",
"v2026.2.6-2",
"v2026.2.6-1",
"v2026.2.6",
"v2026.2.3",
"v2026.2.2",
"v2026.2.1",
"v2026.1.30",
"v2026.1.29",
"v2026.1.24-1",
"v2026.1.24",
"v2026.1.23",
"v2026.1.22",
"v2026.1.21",
"v2026.1.20",
"v2026.1.16-2",
"v2026.1.15",
"v2026.1.14-1",
"v2026.1.13",
"v2026.1.12-2",
"v2026.1.12",
"v2026.1.11-3",
"v2026.1.11-2",
"v2026.1.11-1",
"v2026.1.11",
"v2026.1.10",
"v2026.1.9",
"v2026.1.8",
"v2026.1.5-3",
"v2026.1.5-2",
"v2026.1.5-1",
"v2026.1.5",
"v2.0.0-beta5",
"v2.0.0-beta4",
"v2.0.0-beta3",
"v2.0.0-beta2",
"v2.0.0-beta1",
"v1.3.0",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.0",
"v1.0.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43528.json"
}
}
],
"modified": "2026-10-28T02:30:38.210246685Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43528.json",
"https://github.com/openclaw/openclaw/security/advisories/GHSA-8372-7vhw-cm6q",
"https://nvd.nist.gov/vuln/detail/CVE-2026-43528",
"https://www.vulncheck.com/advisories/openclaw-redaction-bypass-via-sourceconfig-and-runtimeconfig-aliases",
"https://github.com/openclaw/openclaw/commit/86734ef93a2f25063371b04f1946eb300548acd4"
],
"provider_metadata": {
"cwe_ids": [
"CWE-212"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43528.json"
}
},
"related_cves": [
{
"value": "CVE-2026-43528",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505594,
"published_at": "2026-05-05T11:24:59.369+00:00"
}