CVE-2026-40045

CVE-2026-40045 affects OpenClaw prior to 2026.4.2. The Android gateway client accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. An attacker could forge discovery results or craft setup codes to redirect clients to malicio...