Path traversal in OpenClaw - CVE-2026-32061
Published: May 4, 2026
Vulnerability identifier: #VU129415
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-32061
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to path traversal in config $include resolution when processing user-controlled include paths in configuration files. A remote user can specify absolute or traversal paths to disclose sensitive information.
The impact is limited to files readable by the OpenClaw process user.
Affected software
OpenClaw
How to mitigate CVE-2026-32061
Install security update from vendor's website.
OpenClaw - update to 2026.2.17