Detections
Analytics

SCA: security update for openclaw (GHSA-pv58-549p-qh99)

high Tenable Cloud Security Plugin ID 437769

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenClaw is a personal AI assistant. Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such
 as `lanHost`, `tailnetDns`, `gatewayPort`, and `gatewayTlsSha256`. TXT records are unauthenticated. Prior
 to version 2026.2.14, some clients treated TXT values as authoritative routing/pinning inputs. iOS and
 macOS used TXT-provided host hints (`lanHost`/`tailnetDns`) and ports (`gatewayPort`) to build the
 connection URL. iOS and Android allowed the discovery-provided TLS fingerprint (`gatewayTlsSha256`) to
 override a previously stored TLS pin. On a shared/untrusted LAN, an attacker could advertise a rogue
 `_openclaw-gw._tcp` service. This could cause a client to connect to an attacker-controlled endpoint
 and/or accept an attacker certificate, potentially exfiltrating Gateway credentials (`auth.token` /
 `auth.password`) during connection. As of time of publication, the iOS and Android apps are alpha/not
 broadly shipped (no public App Store / Play Store release). Practical impact is primarily limited to
 developers/testers running those builds, plus any other shipped clients relying on discovery on a
 shared/untrusted LAN. Version 2026.2.14 fixes the issue. Clients now prefer the resolved service endpoint
 (SRV + A/AAAA) over TXT-provided routing hints. Discovery-provided fingerprints no longer override stored
 TLS pins. In iOS/Android, first-time TLS pins require explicit user confirmation (fingerprint shown; no
 silent TOFU) and discovery-based direct connects are TLS-only. In Android, hostname verification is no
 longer globally disabled (only bypassed when pinning). (CVE-2026-26327)

See Also

https://github.com/advisories/GHSA-pv58-549p-qh99

Plugin Details

Severity: High

ID: 437769

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 2/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-26327

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/18/2026

Vulnerability Publication Date: 2/18/2026

Reference Information

CVE: CVE-2026-26327

cwe: CWE-345