OpenClaw Credential Fallback Vulnerability Allowing Authentication Bypass

A credential fallback vulnerability has been identified in OpenClaw versions prior to 2026.3.11. This vulnerability arises because unavailable local authentication SecretRefs for gateway.auth.token and gateway.auth.password are incorrectly treated as unset. As a result, the system can fall back to remote credentials while in local mode. Attackers may exploit this flaw by misconfiguring local authentication references, causing the command-line interface (CLI) and helper paths to choose incorrect credential sources. This could potentially bypass intended local authentication boundaries.

Impact

Exploitation of this vulnerability could lead to a bypass of local authentication boundaries, allowing for unauthorized access or actions within the application.

Remediation

Users are advised to upgrade to OpenClaw version 2026.3.11 or later.