Skip to content

Comments

security: add mDNS discovery config to reduce information disclosure#1882

Merged
steipete merged 2 commits intoopenclaw:mainfrom
orlyjamie:fix/mdns-info-disclosure
Jan 26, 2026
Merged

security: add mDNS discovery config to reduce information disclosure#1882
steipete merged 2 commits intoopenclaw:mainfrom
orlyjamie:fix/mdns-info-disclosure

Conversation

@orlyjamie
Copy link
Contributor

@orlyjamie orlyjamie commented Jan 25, 2026

mDNS broadcasts can expose sensitive operational details like filesystem paths (cliPath) and SSH availability (sshPort) to anyone on the local network. This information aids reconnaissance and should be minimized for gateways exposed beyond trusted networks.

Example..

https://www.shodan.io/search?query=clawdbot
image

Changes:

  • Add discovery.mdns.enabled config option to disable mDNS entirely
  • Add discovery.mdns.minimal option to omit cliPath/sshPort from TXT records
  • Update security docs with operational security guidance

Minimal mode still broadcasts enough for device discovery (role, gatewayPort, transport) while omitting details that help map the host environment. Apps that need CLI path can fetch it via the authenticated WebSocket.

@thewilloftheshadow thewilloftheshadow added the gateway Gateway runtime label Jan 26, 2026
@orlyjamie orlyjamie mentioned this pull request Jan 26, 2026
Closed
orlyjamie and others added 2 commits January 26, 2026 13:19
@orlyjamie @steipete
security: add mDNS discovery config to reduce information disclosure
25f32a1 
mDNS broadcasts can expose sensitive operational details like filesystem
paths (cliPath) and SSH availability (sshPort) to anyone on the local
network. This information aids reconnaissance and should be minimized
for gateways exposed beyond trusted networks.

Changes:
- Add discovery.mdns.enabled config option to disable mDNS entirely
- Add discovery.mdns.minimal option to omit cliPath/sshPort from TXT records
- Update security docs with operational security guidance

Minimal mode still broadcasts enough for device discovery (role, gatewayPort,
transport) while omitting details that help map the host environment.
Apps that need CLI path can fetch it via the authenticated WebSocket.
@steipete
fix: default mDNS discovery mode to minimal (openclaw#1882) (thanks @…
15d4738 
…orlyjamie)
@steipete steipete force-pushed the fix/mdns-info-disclosure branch from ccf00f0 to 15d4738 Compare January 26, 2026 13:32
@steipete steipete merged commit a1f9825 into openclaw:main Jan 26, 2026
41 of 43 checks passed
@steipete
Copy link
Contributor

steipete commented Jan 26, 2026

Landed via temp rebase onto main.

  • Gate: pnpm lint && pnpm build (pnpm test skipped per request)
  • Land commit: 15d4738
  • Merge commit: a1f9825

Thanks @orlyjamie!

@orlyjamie
Copy link
Contributor Author

orlyjamie commented Jan 26, 2026

Likewise thanks @steipete

tyler6204 added a commit that referenced this pull request Jan 27, 2026
@adam91holt @zerone0x
@claude @Alg0rix @steipete @shakkernerd @orlyjamie @mertcicekci0 @rhuanssauro @thewilloftheshadow @YuriNachos @Alex-Alaniz @kentaro @dguido @obviyus @Glucksberg @vignesh07 @alexstyl @hirefrank @czekaj @jaydenfyi @ppamment @Suksham-sharma @dlauer @tyler6204 @AdeboyeDN @robbyczgw-cla @dominicnunez @gumadeiras @techboss @Kiwitwitter @David-Marsh-Photo @chenyuan99 @jogi47 @YiWang24 @0oAstro @kennyklee
Add per-sender group tool policies and fix precedence (#1757)