Orphaned OpenClaw routes still public after service deletion — security blocker
luigipascal
PROOP

8 days ago

Hi Railway team,

We have stale edge routes still serving an OpenClaw / Clawdbot admin panel after the original service was deleted. This is a security blocker (Coalition Control finding: Clawdbot Panel Exposed).

Project: 4schools

Project ID: f800317b-49cc-4cb9-87a1-703218517548

Environment: production

Stale endpoints still serving OpenClaw publicly:

HTTPS (orphaned generated hostname)

https://openclaw-gateway-production.up.railway.app/

Returns HTTP 200

Serves OpenClaw Control HTML (OpenClaw Control)

Resolves to 69.46.46.108

Not attached to any service in our project (railway domain status reports: “Domain not found on the selected service”)

TCP (metal route)

http://66.33.22.240:43953/

Port 43953 is open on Railway edge IP 66.33.22.240

Returns HTTP 401 with WWW-Authenticate: Basic realm="OpenClaw Dashboard"

Historically linked to 4schools.rondanini.com (dns-a TCP)

Networking → TCP Proxy is empty; railway tcp-proxy list returns "proxies": []

What we already tried (same pattern as this thread):

https://station.railway.com/questions/orphaned-generated-hostname-still-servin-03180964

We created a new empty service openclaw-gateway (service ID 8dee0bd5-a413-4441-9057-efa20c90b7a8) with a new generated domain:

https://openclaw-gateway-production-a8b5.up.railway.app/ → 404 (expected / safe)

The old hostname above still serves the live OpenClaw UI, so the orphan was not cleared.

Request:

Please remove or detach the stale edge routes for:

openclaw-gateway-production.up.railway.app

Public TCP access on 66.33.22.240:43953

We no longer run OpenClaw and do not need these routes. Once removed, we will verify externally and request a rescan from our security scanner.

Evidence commands:

curl -I https://openclaw-gateway-production.up.railway.app/

curl -I http://66.33.22.240:43953/

Thanks,

Luigi / Rondanini

luigi@rondanini.com

$20 Bounty

3 Replies

Status changed to Awaiting Railway Response Railway 8 days ago


8 days ago

Have you redeployed the service since removing the domain?


Status changed to Awaiting User Response Railway 8 days ago


noahd

Have you redeployed the service since removing the domain?

luigipascal
PROOP

7 days ago

4schools (main app): Still running on custom domain 4schools.rondanini.com (ACTIVE). I have not redeployed it since any domain change. Last successful deploy: 17 June 2026 (deployment 82689dd0-2b39-47a7-b31d-63c23a0dacfb). openclaw-gateway: Was an orphaned service — Offline, no active deployment, with Railway subdomain openclaw-gateway-production-a8b5.up.railway.app. I did not need OpenClaw on this project.

Action taken 29 June 2026: Deleted openclaw-gateway from production via CLI.

Verified: The 4schools project now contains only the 4schools service (6b902fe9-f4a4-4f4f-a1a1-2a65d402bc6a).


Status changed to Awaiting Railway Response Railway 7 days ago


Railway
BOT

7 days ago

This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.

Status changed to Open Railway 7 days ago


lleywyn
PROTop 5% Contributor

4 days ago

a deleted service can't serve its own admin panel, railway's edge just proxies, it can't fake that openclaw html or a basic-auth prompt. so it's still running somewhere. check every environment in the project, not just production, the domain and tcp route are almost certainly still attached to it in one you're not looking at. and rotate those creds now, it's live-exposed till the route's actually gone.


Welcome!

Sign in to your Railway account to join the conversation.

Loading...