GHSA-p2fh-f5fc-44hr: OpenClaw memory-wiki ingest

Q: Is GHSA-p2fh-f5fc-44hr actively exploited?

No confirmed active exploitation of GHSA-p2fh-f5fc-44hr has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-p2fh-f5fc-44hr?

Update to OpenClaw 2026.5.12 or later, which patches the missing path restriction in memory-wiki ingest. Until patched, restrict memory-wiki write access to fully trusted operators only, and avoid sharing a single Gateway instance between mutually untrusted users. Keep channel and tool allowlists narrow, and disable the memory-wiki ingest feature entirely if it isn't in active use. For detection, audit Gateway/tool-invocation logs for ingest calls referencing paths outside the configured ingest source directories (absolute paths, `../` traversal, access to `/etc/`, SSH keys, `.env` files, or cloud credential paths), and review wiki memory contents for unexpected file imports.

Q: What systems are affected by GHSA-p2fh-f5fc-44hr?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, local file system integrations.

Q: What is the CVSS score for GHSA-p2fh-f5fc-44hr?

GHSA-p2fh-f5fc-44hr has a CVSS v3.1 base score of 6.5 (MEDIUM).

CISO Take

A patched flaw in OpenClaw's memory-wiki ingest feature let an authenticated Gateway operator holding only operator.write scope on the plugin tool read arbitrary local files instead of the sources the ingest job was configured to pull from, turning a narrow write permission into a confidentiality-only read primitive (CVSS 6.5, C:H/I:N/A:N). There's no CISA KEV listing, no public exploit code, and no published EPSS score, but the bug sits in a package with 425 other tracked CVEs, so exposure per-deployment is low-probability while the package's overall vulnerability velocity still warrants scrutiny. Because the flaw only requires an existing operator.write grant rather than a fresh authentication bypass, it's most dangerous in multi-tenant Gateway setups where mutually untrusted users share one instance, letting a lower-trust operator harvest local secrets, config files, or credentials into wiki memory the agent can later surface. Patch to OpenClaw 2026.5.12 or later immediately; until then, restrict memory-wiki write access to fully trusted operators, keep channel and tool allowlists narrow, and disable the feature if it isn't actively used.

Sources: GitHub Advisory CISA KEV ATLAS

What is the risk?

Medium severity (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): network-reachable and low complexity with no user interaction, but gated by a requirement for existing operator.write privilege on the Gateway, which narrows the attacker pool to already-onboarded operators or plugin callers rather than anonymous internet actors. Impact is confidentiality-only — arbitrary local file disclosure, no tampering or availability loss. No EPSS score is published, the CVE is not in CISA KEV, and no public exploit or Nuclei template exists, so there is no evidence of active or automated exploitation today. The openclaw package carries a notably high CVE count (425 tracked issues) in our data, which flags it as a fast-moving, heavily-scrutinized codebase — unpatched instances should still be treated as a priority even absent in-the-wild signals for this specific advisory.

How does the attack unfold?

Scoped tool access

An authenticated Gateway operator with operator.write scope invokes the memory-wiki ingest tool, a permission intended only for approved documentation sources.

AML.T0053

Path restriction bypass

The operator supplies an arbitrary local file path instead of a configured ingest source; the tool fails to validate the path stays within intended bounds.

AML.T0037

Sensitive data ingested into memory

The arbitrary file's contents are imported into the agent's persistent wiki memory, exfiltrating local data through a legitimate tool call.

AML.T0086

Disclosure via agent output

The operator, or another user sharing the same Gateway, later queries the agent and the ingested secret content is surfaced in a response.

Scoped tool access

An authenticated Gateway operator with operator.write scope invokes the memory-wiki ingest tool, a permission intended only for approved documentation sources.

AML.T0053

Path restriction bypass

The operator supplies an arbitrary local file path instead of a configured ingest source; the tool fails to validate the path stays within intended bounds.

AML.T0037

Sensitive data ingested into memory

The arbitrary file's contents are imported into the agent's persistent wiki memory, exfiltrating local data through a legitimate tool call.

AML.T0086

Disclosure via agent output

The operator, or another user sharing the same Gateway, later queries the agent and the ingested secret content is surfaced in a response.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	npm	< 2026.5.12	`2026.5.12`
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Update to OpenClaw 2026.5.12 or later, which patches the missing path restriction in memory-wiki ingest. Until patched, restrict memory-wiki write access to fully trusted operators only, and avoid sharing a single Gateway instance between mutually untrusted users. Keep channel and tool allowlists narrow, and disable the memory-wiki ingest feature entirely if it isn't in active use. For detection, audit Gateway/tool-invocation logs for ingest calls referencing paths outside the configured ingest source directories (absolute paths, ../ traversal, access to /etc/, SSH keys, .env files, or cloud credential paths), and review wiki memory contents for unexpected file imports.

How is it classified?

Data Leakage Privacy Violation Auth Bypass Plugin Agent AML.T0037 - Data from Local System AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is GHSA-p2fh-f5fc-44hr?

A patched flaw in OpenClaw's memory-wiki ingest feature let an authenticated Gateway operator holding only operator.write scope on the plugin tool read arbitrary local files instead of the sources the ingest job was configured to pull from, turning a narrow write permission into a confidentiality-only read primitive (CVSS 6.5, C:H/I:N/A:N). There's no CISA KEV listing, no public exploit code, and no published EPSS score, but the bug sits in a package with 425 other tracked CVEs, so exposure per-deployment is low-probability while the package's overall vulnerability velocity still warrants scrutiny. Because the flaw only requires an existing operator.write grant rather than a fresh authentication bypass, it's most dangerous in multi-tenant Gateway setups where mutually untrusted users share one instance, letting a lower-trust operator harvest local secrets, config files, or credentials into wiki memory the agent can later surface. Patch to OpenClaw 2026.5.12 or later immediately; until then, restrict memory-wiki write access to fully trusted operators, keep channel and tool allowlists narrow, and disable the feature if it isn't actively used.

Is GHSA-p2fh-f5fc-44hr actively exploited?

No confirmed active exploitation of GHSA-p2fh-f5fc-44hr has been reported, but organizations should still patch proactively.

How to fix GHSA-p2fh-f5fc-44hr?

Update to OpenClaw 2026.5.12 or later, which patches the missing path restriction in memory-wiki ingest. Until patched, restrict memory-wiki write access to fully trusted operators only, and avoid sharing a single Gateway instance between mutually untrusted users. Keep channel and tool allowlists narrow, and disable the memory-wiki ingest feature entirely if it isn't in active use. For detection, audit Gateway/tool-invocation logs for ingest calls referencing paths outside the configured ingest source directories (absolute paths, `../` traversal, access to `/etc/`, SSH keys, `.env` files, or cloud credential paths), and review wiki memory contents for unexpected file imports.

What systems are affected by GHSA-p2fh-f5fc-44hr?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, local file system integrations.

What is the CVSS score for GHSA-p2fh-f5fc-44hr?

GHSA-p2fh-f5fc-44hr has a CVSS v3.1 base score of 6.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelineslocal file system integrations

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

### Summary memory-wiki ingest could read local files with operator.write scope. In affected versions, a Gateway caller with `operator.write` access to the plugin tool could read arbitrary local file paths instead of staying within the intended ingest sources. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, this could import local file content into wiki memory. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. ### Resolution Update to a patched OpenClaw release when one is listed for this advisory. If the Patched versions field is populated, use that version or later. ### Mitigations limit memory-wiki write access to trusted operators until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Exploitation Scenario

An operator granted operator.write scope on the memory-wiki plugin — intended only to let them ingest approved documentation into the agent's knowledge base — instead points the ingest tool at an arbitrary local path such as `.env`, `~/.ssh/id_rsa`, or a cloud credential file. Because the tool doesn't validate that the path falls within the configured ingest sources, the file's contents are read and stored in wiki memory. The operator, or in a shared-Gateway scenario another user able to query that memory, then retrieves the secret material simply by asking the agent a question that causes it to recall or summarize the ingested content — turning a scoped documentation-ingestion permission into full local file disclosure.

Weaknesses (CWE)

CWE-732 Incorrect Permission Assignment for Critical Resource Primary

CWE-732 — Incorrect Permission Assignment for Critical Resource: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

[Implementation] When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]

Source: MITRE CWE corpus.