Executive brief
OpenClaw is an AI automation tool that reads configuration files to execute commands and tasks. A path traversal flaw in its $include directive allows an attacker who can modify the configuration file to read sensitive files (like API keys and credentials) stored on the same system. The vulnerability requires configuration write access and is bounded by the file permissions of the OpenClaw process user.
Technical details
The vulnerability is a path traversal (CWE-22) in OpenClaw's $include configuration directive resolution. The vulnerable component fails to properly validate include paths, allowing an attacker with config file write access to: (1) specify absolute paths (e.g., /etc/passwd) to read arbitrary files, (2) use traversal sequences (e.g., ../../..) to escape the config directory boundary, or (3) create symlinks inside the config directory that point to external files, unless real-path checks are enforced. The attack requires local file system access and config modification capability; it is not a remote unauthenticated vector. A successful exploit exposes secrets, API keys, and private configuration material readable by the OpenClaw process user. The fix was released in version 2026.2.17 (commit d1c00dbb7c64a39e205464dae7f2a068420e91c1), which hardens include resolution to confine it to the top-level config directory and adds cross-platform-safe path containment checks.
Affected products
- OpenClaw openclaw <=2026.2.15
Timeline
- 2026-03-03: disclosed
- 2026-02-18: patched: Fix committed; version 2026.2.17 released