Anmelden
Deutsch English Español Polski
Kritisch

OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

  • Veröffentlicht: 02.03.2026
  • Aktualisiert: 11.10.2026 10:22

Impact

The gateway agents.files.get and agents.files.set methods allowed symlink traversal for allowlisted workspace files. A symlinked allowlisted file (for example AGENTS.md) could resolve outside the agent workspace and be read/written by the gateway process.

This could enable arbitrary host file read/write within the gateway process permissions, and chained impact up to code execution depending on which files are overwritten.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.24
  • Latest published vulnerable version at patch time: 2026.2.24
  • Patched versions: >= 2026.2.25

Remediation

agents.files now resolves real workspace paths, enforces containment for resolved targets, rejects out-of-workspace symlink targets, and keeps in-workspace symlink targets supported. The patch also adds gateway regression tests for blocked escapes and valid in-workspace symlink behavior.

Fix Commit(s)

  • 125f4071bcbc0de32e769940d07967db47f09d3d

Release Process Note

patched_versions is intentionally pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
npm-Paket openclaw < 2026.2.25 2026.2.25

Verweise

CVSS-Wert 8.8/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Schwäche (CWE)
CWE-22, CWE-59
Plattform
npm
Paket
openclaw
Veröffentlicht
02.03.2026
Aktualisiert
11.10.2026 10:22

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-fgvx-58p6-gjwc - CC BY 4.0

Schwachstellenhistorie: openclaw

Alle veröffentlichten Schwachstellen dieses Pakets (npm-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (589) im Archiv
Einträge insgesamt
589
Erste → letzte
02.2026 10.2026
Ohne Fix
9
In Angriffen ausgenutzt
0

Verteilung nach Schweregrad

  • Kritisch 20
  • Hoch 215
  • Mittel 300
  • Niedrig 54

Veröffentlichungen pro Jahr

Schweregrad:
  1. OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write dieser Eintrag
    Kritisch · 8.8 CVE-2026-32013 < 2026.2.25 2026.2.25
  2. OpenClaw: Native command authorization could skip owner-command enforcement
    Hoch CVE-2026-53828 < 2026.5.6 2026.5.6
  3. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Hoch · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  4. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Hoch CVE-2026-53839 < 2026.5.7 2026.5.7
  5. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Hoch CVE-2026-53807 < 2026.5.6 2026.5.6
  6. OpenClaw: Matrix allowFrom could bind to mutable display names
    Hoch · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  7. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Hoch · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  8. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Hoch · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  9. OpenClaw: Fake package roots could influence memory-core artifact loading
    Hoch · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  10. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Hoch · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  11. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Hoch · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  12. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Hoch · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  13. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Kritisch CVE-2026-34507 < 2026.4.29 2026.4.29
  14. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Hoch · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  15. OpenClaw: Slack allowFrom could bind to mutable display names
    Hoch CVE-2026-53823 < 2026.5.3 2026.5.3
  16. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Hoch · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  17. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Hoch · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  18. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Hoch · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  19. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Hoch · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  20. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Hoch · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  21. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Hoch · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  22. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Hoch · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  23. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Hoch · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  24. OpenClaw: Shell wrapper argv could change between approval and execution
    Hoch CVE-2026-53822 < 2026.5.18 2026.5.18
  25. OpenClaw: Exec approval display truncation could hide the command being approved
    Hoch · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  26. OpenClaw: Message read actions could skip channel allowlist checks
    Hoch · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  27. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Hoch · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  28. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Hoch · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  29. OpenClaw: Discord allowFrom could bind to mutable display names
    Hoch · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  30. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Hoch · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  31. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Hoch · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  32. OpenClaw: Zalo allowFrom could bind to mutable display names
    Hoch · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  33. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Hoch · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  34. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Hoch · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  35. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Hoch · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  36. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Hoch · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  37. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Hoch · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  38. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Hoch · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  39. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Hoch · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  40. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Hoch · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  41. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Hoch · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  42. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Hoch · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  43. OpenClaw: Feishu webhook and card-action validation now fail closed
    Kritisch · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  44. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Kritisch · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  45. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Hoch CVE-2026-43533 < 2026.4.10 2026.4.10
  46. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Hoch · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  47. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Hoch · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  48. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Hoch · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  49. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Hoch · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  50. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Hoch CVE-2026-43581 < 2026.4.10 2026.4.10
  51. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Hoch · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  52. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Hoch · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  53. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Hoch · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  54. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Hoch CVE-2026-43528 < 2026.4.14 2026.4.14
  55. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Hoch CVE-2026-40037 < 2026.4.8 2026.4.8
  56. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Hoch · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  57. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Hoch CVE-2026-42427 < 2026.4.8 2026.4.8
  58. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Hoch ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  59. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Hoch ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  60. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Hoch · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  61. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Hoch · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  62. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    Hoch CVE-2026-34511 < 2026.4.2 2026.4.2
  63. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    Hoch CVE-2026-41393 < 2026.3.31 2026.3.31
  64. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    Hoch · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  65. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    Hoch CVE-2026-41353 < 2026.3.22 2026.3.22
  66. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    Hoch · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  67. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Kritisch · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  68. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    Hoch · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  69. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    Hoch CVE-2026-41404 < 2026.3.31 2026.3.31
  70. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    Hoch CVE-2026-41349 < 2026.3.28 2026.3.28
  71. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    Hoch · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  72. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    Hoch · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  73. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    Hoch · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  74. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    Hoch CVE-2026-41366 < 2026.3.31 2026.3.31
  75. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    Hoch · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  76. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    Hoch · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  77. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    Hoch · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  78. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    Hoch · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  79. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Kritisch CVE-2026-41329 < 2026.3.31 2026.3.31
  80. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    Hoch · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  81. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Kritisch · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
  82. OpenClaw gateway exec allow-always over-trusts positional carrier executables
    Hoch · 7.3 CVE-2026-41380 < 2026.3.28 2026.3.28
  83. OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`
    Hoch CVE-2026-41371 < 2026.3.28 2026.3.28
  84. OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper
    Hoch · 7.3 CVE-2026-41390 < 2026.3.28 2026.3.28
  85. OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
    Hoch · 9.6 CVE-2026-41387 < 2026.3.22 2026.3.22
  86. OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing
    Hoch CVE-2026-41299 < 2026.3.28 2026.3.28
  87. OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
    Hoch · 7.7 CVE-2026-41368 < 2026.3.28 2026.3.28
  88. OpenClaw's message tool media parameter bypasses tool policy filesystem isolation
    Hoch · 6.2 CVE-2026-33581 < 2026.3.24 2026.3.24
  89. OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals
    Hoch · 8.8 CVE-2026-41303 < 2026.3.28 2026.3.28
  90. OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
    Hoch · 7.5 CVE-2026-34503 < 2026.3.28 2026.3.28
  91. OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
    Hoch · 7.3 CVE-2026-41342 < 2026.3.28 2026.3.28
  92. OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation
    Kritisch CVE-2026-33579 < 2026.3.28 2026.3.28
  93. OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
    Hoch CVE-2026-41395 < 2026.3.28 2026.3.28
  94. OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
    Hoch · 8.1 CVE-2026-35653 < 2026.3.24 2026.3.24
  95. OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
    Hoch CVE-2026-35621 < 2026.3.24 2026.3.24
  96. OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
    Hoch · 8.6 CVE-2026-35641 < 2026.3.24 2026.3.24
  97. OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
    Hoch · 7.7 CVE-2026-35668 < 2026.3.24 2026.3.24
  98. OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
    Hoch CVE-2026-35629 < 2026.3.28 2026.3.28
  99. OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
    Hoch CVE-2026-35636 >= 2026.3.11, < 2026.3.28 2026.3.28
  100. OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
    Hoch CVE-2026-35669 <= 2026.3.24 keine Korrektur
  101. OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
    Kritisch CVE-2026-35625 <= 2026.3.24 keine Korrektur
Mehr anzeigen (20) 101 von 235 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.