openclaw - 💡(How to fix) Fix [Bug]: Docker setup script prints the full gateway bearer token to stdout [2 pull requests]

Severity Assessment

CVSS Assessment

Threat Model Alignment

Classification: security-specific

The issue crosses a documented trust boundary because attacker-controlled input can trigger behavior that the protected component should reserve for authorized callers. This is exploitable vulnerability behavior rather than advisory hardening because the current implementation permits a concrete security property violation.

Impact

The Docker setup flow discloses a full-privilege gateway bearer secret to any party that can read setup stdout/stderr. In common production setups that means CI logs, remote shell transcript capture, or shared bastion history can be turned directly into operator-level access.

Affected Component

Files: scripts/docker/setup.sh:575-576, scripts/docker/setup.sh:709-718

echo "Gateway token: $OPENCLAW_GATEWAY_TOKEN"
...
echo "Gateway running with host port mapping."
echo "Access from tailnet devices via the host's tailnet IP."
echo "Config: $OPENCLAW_CONFIG_DIR"
echo "Workspace: $OPENCLAW_WORKSPACE_DIR"
echo "Token: $OPENCLAW_GATEWAY_TOKEN"
echo ""
echo "Commands:"
echo "  ${COMPOSE_HINT} exec openclaw-gateway node dist/index.js health --token "$OPENCLAW_GATEWAY_TOKEN""

Technical Reproduction

1. On a Docker-capable host, run OPENCLAW_SKIP_ONBOARDING=1 bash scripts/docker/setup.sh 2>&1 | tee setup.log.
2. Inspect setup.log and observe the plaintext Gateway token: / Token: lines.
3. Use the captured secret against the gateway, for example curl -H "Authorization: Bearer <captured-token>" http://<gateway-host>:18789/ready, and observe that the request is accepted as the trusted operator.

Demonstrated Impact

The leak is deterministic because the script always echoes the secret after resolving or generating OPENCLAW_GATEWAY_TOKEN. Existing controls do not mitigate this path because the disclosure happens before any redaction boundary and the script intentionally prints the raw secret value. Since OpenClaw treats possession of the shared gateway secret as operator access, the bug turns setup logs directly into reusable control-plane credentials.

Environment

Release v2026.5.18 published at 2026-05-18T18:54:22Z, commit 50a2481652b6a62d573ece3cead60400dc77020d on openclaw/openclaw, using the official Docker bootstrap flow in scripts/docker/setup.sh.

Remediation Advice

Never print the raw gateway secret. Replace it with a masked fingerprint and direct operators to explicit retrieval or rotation commands when they need to verify the configured credential.