CVE-2026-32061: OpenClaw $include path traversal

CISO Take

CVE-2026-32061 is a path traversal flaw in OpenClaw's config `$include` directive: an attacker who already has config-modification capability can use absolute paths, `../` traversal sequences, or symlinks to force the agent to read arbitrary local files, including API keys and credentials, from outside the intended config directory boundary. The high privilege requirement (PR:H) and a very low EPSS score of 0.15% keep the likelihood of opportunistic exploitation low, and there's no CISA KEV listing, no public exploit, and no Nuclei template — CISA's SSVC decision is TRACK, meaning routine patching rather than emergency response. Blast radius is still worth noting: OpenClaw is classified as an AI agent framework with 4 downstream dependents and 426 other CVEs already tracked against the package, and credential leakage of this kind is exactly the failure mode already documented in OpenClaw's third-party skills ecosystem (AIID #1368, malicious ClawHub skills exfiltrating credentials). Patch to OpenClaw 2026.2.17 or later, and in the meantime audit who holds config-write access and ensure `$include` resolution is jailed to the config directory (no symlink or absolute-path escape) via file permissions or a canonicalizing loader.

Sources: NVD CISA KEV EPSS GitHub Advisory vulncheck.com ATLAS

What is the risk?

Medium severity (CVSS 4.4) with a confidentiality-only impact (C:H/I:N/A:N) — no integrity or availability loss. Exploitability is low-friction once achieved (AC:L, UI:N) but gated by a high privilege requirement (PR:H): the attacker must already have some ability to modify OpenClaw's configuration, which limits this to insider threats, compromised CI/deployment pipelines, or supply-chain footholds (e.g. a malicious 'skill' as seen in AIID #1368) rather than remote unauthenticated attackers. EPSS of 0.15% and absence from CISA KEV, combined with no public exploit or scanner template, support the SSVC TRACK verdict — this is a real but not urgent risk that should be patched on a normal cadence rather than treated as an active-exploitation emergency.

How does the attack unfold?

Config tampering

Attacker with config-write access (compromised CI, malicious skill, or insider) inserts a $include directive with a traversal path, absolute path, or symlink into OpenClaw's configuration.

AML.T0081

Path traversal exploitation

OpenClaw resolves the $include directive without confining it to the config directory boundary, following the traversal sequence or symlink to a file outside the intended scope.

AML.T0037

Credential access

The process reads the targeted local file, which contains API keys or other credentials readable by the OpenClaw process user, into the agent's configuration or context.

AML.T0083

Exfiltration and impact

The attacker retrieves the leaked secret from agent output, logs, or merged config, enabling account takeover or lateral movement into connected services.

AML.T0055

Config tampering

Attacker with config-write access (compromised CI, malicious skill, or insider) inserts a $include directive with a traversal path, absolute path, or symlink into OpenClaw's configuration.

AML.T0081

Path traversal exploitation

OpenClaw resolves the $include directive without confining it to the config directory boundary, following the traversal sequence or symlink to a file outside the intended scope.

AML.T0037

Credential access

The process reads the targeted local file, which contains API keys or other credentials readable by the OpenClaw process user, into the agent's configuration or context.

AML.T0083

Exfiltration and impact

The attacker retrieves the leaked secret from agent output, logs, or merged config, enabling account takeover or lateral movement into connected services.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.4 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR High

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade to OpenClaw 2026.2.17 or later, which fixes the $include path resolution boundary (see patch commit d1c00dbb7c64a39e205464dae7f2a068420e91c1). Until patched: restrict who/what can write to OpenClaw config files (CI service accounts, shared-config repos, skill installers); disallow untrusted config contributions or review them before deployment; and where possible, validate that $include targets canonicalize to paths inside the config directory before OpenClaw processes them. For detection, monitor OpenClaw process file access for reads outside the expected config directory, enable file integrity monitoring on config paths, and audit logs for $include resolutions pointing to absolute paths, ../ sequences, or symlinked targets. Store secrets in a secrets manager rather than plaintext config files where feasible, so a successful traversal has less to yield.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Privacy Violation Agent Framework AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.6 - AI system security controls

NIST AI RMF

MANAGE 4.1 - Regular monitoring and mitigation of AI system risks including third-party components

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-32061?

CVE-2026-32061 is a path traversal flaw in OpenClaw's config `$include` directive: an attacker who already has config-modification capability can use absolute paths, `../` traversal sequences, or symlinks to force the agent to read arbitrary local files, including API keys and credentials, from outside the intended config directory boundary. The high privilege requirement (PR:H) and a very low EPSS score of 0.15% keep the likelihood of opportunistic exploitation low, and there's no CISA KEV listing, no public exploit, and no Nuclei template — CISA's SSVC decision is TRACK, meaning routine patching rather than emergency response. Blast radius is still worth noting: OpenClaw is classified as an AI agent framework with 4 downstream dependents and 426 other CVEs already tracked against the package, and credential leakage of this kind is exactly the failure mode already documented in OpenClaw's third-party skills ecosystem (AIID #1368, malicious ClawHub skills exfiltrating credentials). Patch to OpenClaw 2026.2.17 or later, and in the meantime audit who holds config-write access and ensure `$include` resolution is jailed to the config directory (no symlink or absolute-path escape) via file permissions or a canonicalizing loader.

Is CVE-2026-32061 actively exploited?

No confirmed active exploitation of CVE-2026-32061 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32061?

Upgrade to OpenClaw 2026.2.17 or later, which fixes the `$include` path resolution boundary (see patch commit d1c00dbb7c64a39e205464dae7f2a068420e91c1). Until patched: restrict who/what can write to OpenClaw config files (CI service accounts, shared-config repos, skill installers); disallow untrusted config contributions or review them before deployment; and where possible, validate that `$include` targets canonicalize to paths inside the config directory before OpenClaw processes them. For detection, monitor OpenClaw process file access for reads outside the expected config directory, enable file integrity monitoring on config paths, and audit logs for `$include` resolutions pointing to absolute paths, `../` sequences, or symlinked targets. Store secrets in a secrets manager rather than plaintext config files where feasible, so a successful traversal has less to yield.

What systems are affected by CVE-2026-32061?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant agent configurations, CI/CD-integrated AI agents.

What is the CVSS score for CVE-2026-32061?

CVE-2026-32061 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant agent configurationsCI/CD-integrated AI agents

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config directory boundary. Attackers with config modification capabilities can exploit this by specifying absolute paths, traversal sequences, or symlinks to access sensitive files readable by the OpenClaw process user, including API keys and credentials.

Exploitation Scenario

An attacker gains config-modification capability against a target's OpenClaw deployment — for example by compromising a CI pipeline that generates agent configs, contributing a poisoned config change to a shared repo, or (per the pattern seen in AIID #1368) delivering a malicious ClawHub 'skill' that includes a crafted config snippet. The attacker adds a `$include` directive pointing to an absolute path, `../../`-style traversal sequence, or a symlink targeting a sensitive file readable by the OpenClaw process user — such as a cloud credentials file, SSH key, or another service's API key. When OpenClaw resolves the include, it reads the file contents into its own configuration/context, and the attacker retrieves the leaked secret via subsequent agent output, logs, or direct file/API access to the merged config, enabling account takeover or lateral movement into connected services.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.