CVE-2026-26972: OpenClaw path traversal

CISO Take

OpenClaw's browser download helpers accept unsanitized output paths via the browser control gateway routes, allowing an authenticated attacker to write files anywhere on the filesystem rather than the intended temp directory. Despite the medium CVSS score (6.7), the confidentiality, integrity, and availability impact are all rated High — meaning a compromised authenticated session can yield a full filesystem write primitive, enabling persistence, config tampering, or staged code execution. OpenClaw already carries 11 other CVEs in this same package, and a related incident (AIID #1368) documented malicious OpenClaw skills actively delivering credential stealers in early 2026, raising the stakes for any authenticated foothold in this environment. Upgrade to version 2026.2.13 immediately; if patching must be delayed, rotate RPC gateway tokens and restrict CLI access to the minimum necessary users.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

The local attack vector and high-privilege requirement limit opportunistic exploitation — this is not remotely triggerable without credentials. However, in enterprise or team deployments where RPC gateway tokens are shared across automation pipelines or CI processes, the effective attack surface expands considerably. The High C/I/A impact scores signal that post-exploitation impact is disproportionate to the CVSS base score, particularly in environments where OpenClaw runs with broad filesystem permissions as a local AI assistant. The package's history of 11 CVEs indicates ongoing security debt and warrants closer scrutiny of the overall OpenClaw deployment posture.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 41% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Upgrade OpenClaw to version 2026.2.13 (patched). Verify the fix via the commit at github.com/openclaw/openclaw/commit/7f0489e4.
If immediate patching is blocked, revoke and rotate all authenticated RPC gateway tokens; restrict CLI access to only named, necessary users.
Audit OpenClaw temp download directory and parent directories for unexpected files or modified configs written outside the temp path.
Deploy endpoint detection rules for filesystem writes originating from the OpenClaw process to paths outside its designated temp directory.
Review RPC gateway network exposure — if reachable beyond localhost, add firewall restrictions immediately.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 2.2 - Risk treatments are tracked and documented

OWASP LLM Top 10

LLM05 - Improper Output Handling LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-26972?

OpenClaw's browser download helpers accept unsanitized output paths via the browser control gateway routes, allowing an authenticated attacker to write files anywhere on the filesystem rather than the intended temp directory. Despite the medium CVSS score (6.7), the confidentiality, integrity, and availability impact are all rated High — meaning a compromised authenticated session can yield a full filesystem write primitive, enabling persistence, config tampering, or staged code execution. OpenClaw already carries 11 other CVEs in this same package, and a related incident (AIID #1368) documented malicious OpenClaw skills actively delivering credential stealers in early 2026, raising the stakes for any authenticated foothold in this environment. Upgrade to version 2026.2.13 immediately; if patching must be delayed, rotate RPC gateway tokens and restrict CLI access to the minimum necessary users.

Is CVE-2026-26972 actively exploited?

No confirmed active exploitation of CVE-2026-26972 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-26972?

1. Upgrade OpenClaw to version 2026.2.13 (patched). Verify the fix via the commit at github.com/openclaw/openclaw/commit/7f0489e4. 2. If immediate patching is blocked, revoke and rotate all authenticated RPC gateway tokens; restrict CLI access to only named, necessary users. 3. Audit OpenClaw temp download directory and parent directories for unexpected files or modified configs written outside the temp path. 4. Deploy endpoint detection rules for filesystem writes originating from the OpenClaw process to paths outside its designated temp directory. 5. Review RPC gateway network exposure — if reachable beyond localhost, add firewall restrictions immediately.

What systems are affected by CVE-2026-26972?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI assistants, AI-enabled desktop applications.

What is the CVSS score for CVE-2026-26972?

CVE-2026-26972 has a CVSS v3.1 base score of 6.7 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI assistantsAI-enabled desktop applications

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized output path. When invoked via the browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory. This issue is not exposed via the AI agent tool schema (no `download` action). Exploitation requires authenticated CLI access or an authenticated gateway RPC token. Version 2026.2.13 fixes the issue.

Exploitation Scenario

An attacker who has obtained a valid RPC gateway token — through credential theft from a developer workstation, a leaked CI/CD secret, or the malicious OpenClaw skill ecosystem documented in AIID #1368 — sends a crafted gateway request invoking the browser download helper with a path such as '../../~/.config/openclaw/agent.conf' or '../../etc/cron.d/persistence'. Because the path is passed unsanitized, OpenClaw writes attacker-controlled content to the targeted location. In an AI agent deployment context, overwriting the agent configuration file would allow the adversary to redirect tool invocations, inject malicious system prompts, or disable safety controls — effectively taking over the agent's behavior for future sessions without triggering re-authentication.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.