CVE-2026-32061

MEDIUM

4.4

Description

OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config directory boundary. Attackers with config modification capabilities can exploit this by specifying absolute paths, traversal sequences, or symlinks to access sensitive files readable by the OpenClaw process user, including API keys and credentials.

CVE Details

CVSS v3.1 Score4.4

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published3/11/2026

Last Modified3/16/2026

Sourcenvd

Honeypot Sightings0

Affected Products

openclaw:openclaw

Weaknesses (CWE)

CWE-22

References

https://github.com/openclaw/openclaw/commit/d1c00dbb7c64a39e205464dae7f2a068420e91c1(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/security/advisories/GHSA-56pc-6hvp-4gv4(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-include-directive-path-traversal(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.