8 days ago
Hi Railway team,
We have stale edge routes still serving an OpenClaw / Clawdbot admin panel after the original service was deleted. This is a security blocker (Coalition Control finding: Clawdbot Panel Exposed).
Project: 4schools
Project ID: f800317b-49cc-4cb9-87a1-703218517548
Environment: production
Stale endpoints still serving OpenClaw publicly:
HTTPS (orphaned generated hostname)
https://openclaw-gateway-production.up.railway.app/
Returns HTTP 200
Serves OpenClaw Control HTML (OpenClaw Control)
Resolves to 69.46.46.108
Not attached to any service in our project (railway domain status reports: “Domain not found on the selected service”)
TCP (metal route)
Port 43953 is open on Railway edge IP 66.33.22.240
Returns HTTP 401 with WWW-Authenticate: Basic realm="OpenClaw Dashboard"
Historically linked to 4schools.rondanini.com (dns-a TCP)
Networking → TCP Proxy is empty; railway tcp-proxy list returns "proxies": []
What we already tried (same pattern as this thread):
https://station.railway.com/questions/orphaned-generated-hostname-still-servin-03180964
We created a new empty service openclaw-gateway (service ID 8dee0bd5-a413-4441-9057-efa20c90b7a8) with a new generated domain:
https://openclaw-gateway-production-a8b5.up.railway.app/ → 404 (expected / safe)
The old hostname above still serves the live OpenClaw UI, so the orphan was not cleared.
Request:
Please remove or detach the stale edge routes for:
openclaw-gateway-production.up.railway.app
Public TCP access on 66.33.22.240:43953
We no longer run OpenClaw and do not need these routes. Once removed, we will verify externally and request a rescan from our security scanner.
Evidence commands:
curl -I https://openclaw-gateway-production.up.railway.app/
curl -I http://66.33.22.240:43953/
Thanks,
Luigi / Rondanini
3 Replies
Status changed to Awaiting Railway Response Railway • 8 days ago
Status changed to Awaiting User Response Railway • 8 days ago
noahd
Have you redeployed the service since removing the domain?
7 days ago
4schools (main app): Still running on custom domain 4schools.rondanini.com (ACTIVE). I have not redeployed it since any domain change. Last successful deploy: 17 June 2026 (deployment 82689dd0-2b39-47a7-b31d-63c23a0dacfb). openclaw-gateway: Was an orphaned service — Offline, no active deployment, with Railway subdomain openclaw-gateway-production-a8b5.up.railway.app. I did not need OpenClaw on this project.
Action taken 29 June 2026: Deleted openclaw-gateway from production via CLI.
Verified: The 4schools project now contains only the 4schools service (6b902fe9-f4a4-4f4f-a1a1-2a65d402bc6a).
Status changed to Awaiting Railway Response Railway • 7 days ago
7 days ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • 7 days ago
4 days ago
a deleted service can't serve its own admin panel, railway's edge just proxies, it can't fake that openclaw html or a basic-auth prompt. so it's still running somewhere. check every environment in the project, not just production, the domain and tcp route are almost certainly still attached to it in one you're not looking at. and rotate those creds now, it's live-exposed till the route's actually gone.