CVE-2026-27522: OpenClaw path traversal enables

CISO Take

OpenClaw versions before 2026.2.24 contain a path traversal flaw (CWE-22) in the sendAttachment and setGroupIcon message handlers that allows any authenticated user to read arbitrary files on the host by supplying absolute paths when sandboxRoot is not configured. In AI agent deployments, the runtime process typically has access to API credentials, .env files, model configs, and training artifacts — precisely the data an attacker would target. Despite medium CVSS (6.5), the attack profile is severe: network-reachable, low-privilege, no user interaction required, and EPSS places it in the top 71% of CVEs by exploitation likelihood. Upgrade to 2026.2.24 immediately; if patching is blocked, explicitly set sandboxRoot in configuration to enforce filesystem sandboxing and audit runtime user permissions to least-privilege.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Functionally higher risk than the medium CVSS suggests. The combination of network accessibility (AV:N), low privilege requirement (PR:L), no user interaction (UI:N), and high confidentiality impact (C:H) means any authenticated user can silently exfiltrate files. AI agent runtimes are particularly exposed because they routinely store LLM provider API keys, authentication tokens, and model configuration in the filesystem. With 396 CVEs in the same package, the security history of OpenClaw compounds risk for teams relying on it as infrastructure.

How does the attack unfold?

Initial Access

Attacker authenticates to the target OpenClaw deployment using any valid low-privilege account — no admin or elevated permissions required.

AML.T0012

Exploitation

Attacker sends a crafted sendAttachment or setGroupIcon message action with the media path set to an absolute filesystem path (e.g., /opt/app/.env or /var/run/secrets/kubernetes.io/serviceaccount/token).

AML.T0053

File Read Bypass

With sandboxRoot unset, OpenClaw's media hydration resolves the absolute path without sandbox restriction and reads the targeted file from the host filesystem.

AML.T0037

Credential Exfiltration

Attacker receives contents of targeted files — LLM provider API keys, database credentials, or model configs — enabling lateral movement into cloud AI services or downstream infrastructure.

AML.T0083

Initial Access

Attacker authenticates to the target OpenClaw deployment using any valid low-privilege account — no admin or elevated permissions required.

AML.T0012

Exploitation

Attacker sends a crafted sendAttachment or setGroupIcon message action with the media path set to an absolute filesystem path (e.g., /opt/app/.env or /var/run/secrets/kubernetes.io/serviceaccount/token).

AML.T0053

File Read Bypass

With sandboxRoot unset, OpenClaw's media hydration resolves the absolute path without sandbox restriction and reads the targeted file from the host filesystem.

AML.T0037

Credential Exfiltration

Attacker receives contents of targeted files — LLM provider API keys, database credentials, or model configs — enabling lateral movement into cloud AI services or downstream infrastructure.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: upgrade openclaw pip package to 2026.2.24 or later — the commit 270ab03e379f9653e15f7033c9830399b66b7e51 closes the bypass.
Workaround (if patching blocked): explicitly configure sandboxRoot in all OpenClaw deployments to a restricted media directory; do not leave it unset.
Runtime hardening: run the OpenClaw process under a dedicated low-privilege user with read access only to explicitly required paths — no API key directories, no ~/.ssh, no .env files.
Detection: audit logs for sendAttachment or setGroupIcon events containing absolute paths (starting with '/') or path traversal sequences ('..') — these should not appear in normal usage.
Rotate any credentials stored in directories accessible to the OpenClaw runtime user as a precautionary measure.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Agent AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.2 - AI system data security

NIST AI RMF

MANAGE-2.2 - Risk treatment and response

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-27522?

OpenClaw versions before 2026.2.24 contain a path traversal flaw (CWE-22) in the sendAttachment and setGroupIcon message handlers that allows any authenticated user to read arbitrary files on the host by supplying absolute paths when sandboxRoot is not configured. In AI agent deployments, the runtime process typically has access to API credentials, .env files, model configs, and training artifacts — precisely the data an attacker would target. Despite medium CVSS (6.5), the attack profile is severe: network-reachable, low-privilege, no user interaction required, and EPSS places it in the top 71% of CVEs by exploitation likelihood. Upgrade to 2026.2.24 immediately; if patching is blocked, explicitly set sandboxRoot in configuration to enforce filesystem sandboxing and audit runtime user permissions to least-privilege.

Is CVE-2026-27522 actively exploited?

No confirmed active exploitation of CVE-2026-27522 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27522?

1. Patch: upgrade openclaw pip package to 2026.2.24 or later — the commit 270ab03e379f9653e15f7033c9830399b66b7e51 closes the bypass. 2. Workaround (if patching blocked): explicitly configure sandboxRoot in all OpenClaw deployments to a restricted media directory; do not leave it unset. 3. Runtime hardening: run the OpenClaw process under a dedicated low-privilege user with read access only to explicitly required paths — no API key directories, no ~/.ssh, no .env files. 4. Detection: audit logs for sendAttachment or setGroupIcon events containing absolute paths (starting with '/') or path traversal sequences ('..') — these should not appear in normal usage. 5. Rotate any credentials stored in directories accessible to the OpenClaw runtime user as a precautionary measure.

What systems are affected by CVE-2026-27522?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent deployments, local filesystem-integrated AI pipelines, multi-user AI assistant platforms.

What is the CVSS score for CVE-2026-27522?

CVE-2026-27522 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent deploymentslocal filesystem-integrated AI pipelinesmulti-user AI assistant platforms

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.

Exploitation Scenario

An attacker with a standard (low-privilege) OpenClaw account sends a crafted sendAttachment message action where the media path is set to an absolute filesystem path such as /opt/app/.env or /home/appuser/.config/openclaw/credentials.json. Because sandboxRoot is unset, OpenClaw's media hydration subsystem resolves the path without sandbox restriction and returns the file contents as attachment data. In an AI agent deployment context, the attacker iterates over predictable paths — LLM provider API key files, Kubernetes secrets mounted at /var/run/secrets/, or model serving configuration — to harvest credentials enabling lateral movement into cloud AI services or downstream systems. No exploit code is required; the attack is reproducible with standard HTTP tooling against the message API endpoint.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.