CVE-2026-32061
OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversal
- State
- Published
- Severity
- 6.7 Medium
- Published
- Mar 11, 2026
- Updated
- Jun 23, 2026
- Reserved
- Mar 10, 2026
Description
OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config directory boundary. Attackers with config modification capabilities can exploit this by specifying absolute paths, traversal sequences, or symlinks to access sensitive files readable by the OpenClaw process user, including API keys and credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.7 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.4 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
openclawopenclaw |
|
References
- GitHub Security Advisory (GHSA-56pc-6hvp-4gv4)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversalthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.