Openclaw CVE-2026-32846

Remote unauthenticated attacker can exploit OpenClaw through version 2026.3.23 via media parsing functions. Attacker submits crafted file paths exploiting incomplete validation in isLikelyLocalPath() and isValidMedia() functions, leveraging allowBareFilename bypass to traverse outside application sandbox and read arbitrary files. No victim interaction required.

The CVSS 8.7 HIGH severity reflects genuine risk given the attack vector characteristics: network-accessible (AV:N), no authentication required (PR:N), low attack complexity (AC:L), and no user interaction needed (UI:N). High confidentiality impact (VC:H) is confirmed as attackers can exfiltrate SSH keys and system configurations. The vulnerability is automatable and enables information disclosure of sensitive credentials that could facilitate lateral movement or privilege escalation in subsequent attack stages. No public exploit identified at time of analysis, and no CISA KEV listing indicates active exploitation campaigns have not been observed. However, path traversal vulnerabilities are well-understood by attackers and exploitation techniques are documented, lowering the barrier to weaponization. Real-world risk is elevated for internet-facing OpenClaw instances, particularly those handling untrusted media inputs, as the attack requires no special conditions beyond network access to the vulnerable endpoint.

An unauthenticated remote attacker crafts a malicious media file reference containing path traversal sequences (e.g., ../../etc/passwd or ../../root/.ssh/id_rsa) and submits it to the OpenClaw media parsing interface via HTTP request. The incomplete validation in isLikelyLocalPath() and isValidMedia() functions, combined with the allowBareFilename bypass, permits the application to process the traversal path and return the contents of files outside the intended sandbox, disclosing SSH private keys, application configuration files containing credentials, or environment files with API tokens that enable further compromise of the system or connected services.