Link following in OpenClaw - CVE-2026-32024
Published: May 1, 2026
Vulnerability identifier: #VU128802
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-32024
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
OpenClaw
OpenClaw
Software vendor:
OpenClaw
OpenClaw
Description
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in avatar handling when resolving local avatar paths. A local user can create a symlink path that resolves outside the configured workspace boundary to disclose sensitive information.
Only files readable by the OpenClaw process can be exposed via gateway avatar surfaces.
Remediation
Install security update from vendor's website.