OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update
Priority HIGH 66CWE-61Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed OpenClaw (OpenClaw): 2026.3.24
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenClaw | OpenClaw | before 2026.3.24 | 2026.3.24 | Patch available | CNA |
| — | openclaw (npm) | up to 2026.2.22 | — | No fix listed | GHSA-7xr2-q9vf-x4r5 |
- OpenClaw VendorOpenClaw Affected before 2026.3.24 Fixed in 2026.3.24 Patch available CNA
- openclaw (npm) Vendor— Affected up to 2026.2.22 Fixed in — No fix listed GHSA-7xr2-q9vf-x4r5
Remediation
- Fix · CNA OpenClaw (OpenClaw) Fixed in 2026.3.24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-35632
- 2026-10-03 Alias added: GHSA-7xr2-q9vf-x4r5
- 2026-10-29 Title updated · CNA
- 2026-10-29 Fix available: OpenClaw/[email protected] · CNA
References
Advisory 2
Other 4
- https://github.com/openclaw/openclaw
- https://github.com/openclaw/openclaw/blob/main/src/gateway/server-methods/agents.ts#L274
- https://github.com/openclaw/openclaw/blob/main/src/gateway/server-methods/agents.ts#L283-L291
- https://github.com/openclaw/openclaw/blob/main/src/gateway/server-methods/agents.ts#L348-L349
More Openclaw vulnerabilities
- TI-2026-25309 OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read CVSS 4.0HIGH 8.7
- TI-2026-20394 Exposure of resource to wrong sphere in OpenClaw CVSS 3.1HIGH 8.8
- TI-2026-27742 OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation CVSS 4.0HIGH 8.4
- TI-2026-27766 OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing CVSS 4.0MEDIUM 6.9
- TI-2026-07315 OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication CVSS 4.0MEDIUM 6.9
- TI-2026-17789 OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run CVSS 4.0HIGH 7.5
Sources
- CVE-2026-35632 · CVE Program
- CVE-2026-35632 · NVD
- FIRST EPSS
- GHSA-7xr2-q9vf-x4r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences