EUVD-2026-21120
GHSA-pmf3-2q63-jmp6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.
AnalysisAI
OpenClaw through version 2026.2.22 allows authenticated local attackers to execute arbitrary code or manipulate system files via symlink traversal in the agents.create and agents.update handlers. The vulnerability stems from unsafe use of fs.appendFile on IDENTITY.md without validating symlink targets, permitting attackers with workspace access to plant symlinks pointing to sensitive files like crontab or SSH configuration directories and inject malicious content through the agent creation/update process.
Technical ContextAI
The vulnerability exploits a classic symlink traversal flaw (CWE-61) in Node.js file operations. The agents.create and agents.update API handlers use fs.appendFile to write to an IDENTITY.md file within a workspace directory, but do not verify whether the file path is a symlink or validate that the resolved target remains within the intended directory. An attacker with workspace access can create a symbolic link at the expected IDENTITY.md location pointing to privileged files such as /etc/cron.d/* (for cron job injection leading to RCE) or ~/.ssh/authorized_keys (for unauthorized access). When the application appends user-controlled content via fs.appendFile, the symlink is followed, allowing arbitrary file modification outside the workspace sandbox.
RemediationAI
Upgrade to OpenClaw version 2026.2.23 or later, which implements proper symlink containment checks in the agents.create and agents.update handlers. The fix should validate that the resolved file path for IDENTITY.md remains within the expected workspace directory and reject or safely handle symlink targets pointing outside the sandbox. Additionally, use fs.openSync with the O_NOFOLLOW flag (or equivalent safe-open semantics) to prevent symlink traversal at the OS level. Refer to the official OpenClaw security advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-7xr2-q9vf-x4r5) for patch confirmation and details. Administrators should audit workspace permissions and restrict agent creation/update capabilities to trusted users pending patch deployment.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following
View allShare
External POC / Exploit Code
Leaving vuln.today