Link following in OpenClaw - CVE-2026-32024
Published: May 1, 2026
Vulnerability identifier: #VU128802
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-32024
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in avatar handling when resolving local avatar paths. A local user can create a symlink path that resolves outside the configured workspace boundary to disclose sensitive information.
Only files readable by the OpenClaw process can be exposed via gateway avatar surfaces.
Affected software
OpenClaw
How to mitigate CVE-2026-32024
Install security update from vendor's website.
OpenClaw - update to 2026.2.22