EUVD-2026-28188Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4Blast Radius
ecosystem impact- 6 npm packages depend on openclaw (6 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.15.
DescriptionCVE.org
OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files within the workspace root. Attackers with access to the memory tool can bypass path restrictions by providing arbitrary workspace Markdown paths to read files outside canonical memory locations or indexed QMD result sets.
AnalysisAI
OpenClaw before version 2026.4.15 allows authenticated users with access to the memory tool to read arbitrary Markdown files within the workspace root by bypassing path restrictions in the QMD backend's memory_get function. The vulnerability enables attackers to access workspace Markdown files outside canonical memory locations or indexed QMD result sets, effectively circumventing the intended memory-path policy. No public exploit code or active exploitation has been identified.
Technical ContextAI
OpenClaw's QMD (Quarto Markdown) backend implements a memory_get function that retrieves Markdown content from workspace directories. The vulnerability exists in the path-resolution logic of the QmdMemoryManager class, which originally accepted any Markdown file path within the workspace root without validating against a whitelist of canonical memory paths. The root cause falls under CWE-183 (Unspecified Weakness Related to File Handling) and represents an insufficient input validation and access control bypass in a file-reading routine. The fix introduces path normalization and restricts reads to only canonical memory files (MEMORY.md, memory.md, DREAMS.md, dreams.md, and the memory/ directory) or previously indexed QMD workspace document paths, as confirmed by the committed changes to qmd-manager.ts.
RemediationAI
Upgrade OpenClaw to version 2026.4.15 or later, which restricts QMD memory_get reads to canonical memory paths (MEMORY.md, memory.md, DREAMS.md, dreams.md, memory/) and previously indexed QMD workspace paths. The fix is available in commit 37d5971db36491d5050efd42c333cbe0b98ed292 and merged via PR #66026. For organizations unable to upgrade immediately, restrict access to the memory tool to only trusted users with a legitimate need for memory functionality, and audit any memory tool access logs for suspicious file-read patterns targeting non-canonical Markdown files. Note that this workaround does not eliminate the vulnerability but reduces the likelihood of exploitation by limiting who can invoke the vulnerable code path. The patch should be applied as soon as feasible to restore the intended memory-path security boundary.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today