Which versions of OpenClaw are affected by CVE-2026-53825?

OpenClaw gateway deployments below version 2026.4.7 are vulnerable to arbitrary local file read attacks when authenticated Gateway operators with write privileges interact with the memory-wiki ingest…. A patch is available.

How to fix or mitigate CVE-2026-53825?

Within 24 hours: Identify all OpenClaw deployments and their current versions; audit operator.write scope assignments and recent memory-wiki ingest activity. Within 7 days: Since no vendor patch is currently available, restrict operator.write scope to minimum necessary personnel and disable memory-wiki ingest feature if operationally feasible. Within 30 days: Establish vendor contact for patch release timeline; evaluate alternative ingest mechanisms or architecture changes to reduce reliance on this feature.

OpenClaw CVE-2026-53825

Q: What is the CVSS score of CVE-2026-53825?

CVE-2026-53825 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36613 HIGH

Path Traversal (CWE-22)

2026-06-12 VulnCheck

GHSA-f76w-jcqf-mh5g

Path Traversal Openclaw

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable Gateway API (AV:N), straightforward path manipulation (AC:L), requires an authenticated operator.write token (PR:L), no user interaction, and impact is confined to file disclosure (C:H, I/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 13, 2026 - 02:00 EUVD

Analysis Generated

Jun 12, 2026 - 22:32 vuln.today

DescriptionCVE.org

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file paths to import file content into wiki memory, bypassing access restrictions.

AnalysisAI

Arbitrary local file read in OpenClaw before 2026.4.7 lets authenticated Gateway operators holding the operator.write scope coerce the memory-wiki ingest feature into importing the contents of arbitrary local files. The flaw, reported by VulnCheck and tracked as GHSA-p2fh-f5fc-44hr, enables disclosure of sensitive host files (credentials, config, secrets) into wiki memory, but no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

OpenClaw exposes a Gateway API whose memory-wiki ingest pipeline is intended to pull content from a restricted set of approved sources into a retrievable wiki/memory store. The vulnerability is a classic CWE-22 path traversal: the ingest endpoint accepts a caller-supplied source path and resolves it on the local filesystem without enforcing that the path stays within the configured ingest roots, so an operator can substitute paths such as /etc/passwd, application config, or token files. The affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* with the boundary fix landing in 2026.4.7, and the relevant authorization boundary is the operator.write OAuth-style scope on the Gateway role model.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.4.7 or later, per the GitHub Security Advisory GHSA-p2fh-f5fc-44hr (https://github.com/openclaw/openclaw/security/advisories/GHSA-p2fh-f5fc-44hr) and the VulnCheck writeup (https://www.vulncheck.com/advisories/openclaw-arbitrary-local-file-read-via-memory-wiki-ingest-with-operator-write-scope). Until the upgrade is rolled out, revoke the operator.write scope from any account that does not strictly need to ingest into memory-wiki and audit existing operator tokens - this removes the exploitation prerequisite but will block legitimate wiki ingest for those operators. As additional hardening, restrict the OpenClaw service account's filesystem permissions so that sensitive files (credentials, private keys, /etc/shadow, application secrets) are not readable by the Gateway process, and place the Gateway API behind network ACLs so only trusted management networks can reach the ingest endpoint; the trade-off is reduced operability for remote operators and additional ops work to manage the allowlist.