CVE-2026-35632: OpenClaw symlink traversal in agents.create and agents.update

Executive brief

OpenClaw is an AI assistant platform. A vulnerability in how it handles agent identity files allows an attacker to trick the system into writing data to sensitive system files. By placing a specially crafted link (symlink) in a workspace, an attacker can append their own data to critical files like system task schedulers or login scripts, potentially leading to full system takeover or service disruption.

Technical details

A symlink traversal vulnerability exists in the agents.create and agents.update handlers within src/gateway/server-methods/agents.ts. These handlers use fs.appendFile on the IDENTITY.md file without performing symlink resolution or workspace boundary checks. While ensureAgentWorkspace uses the 'wx' flag to prevent file overwriting, it silently ignores EEXIST errors if a symlink already exists, allowing the subsequent appendFile call to follow the link. An attacker with local filesystem access to the agent workspace can point IDENTITY.md to sensitive files like /etc/crontab or ~/.ssh/authorized_keys to achieve remote code execution or unauthorized access. This is an incomplete fix for CVE-2026-32013.

Affected products

• openclaw openclaw <= 2026.2.22

Timeline

• 2026-03-24: disclosed
• 2026-03-26: advisory

References

• https://api.github.com/users/YLChen-007
• https://github.com/YLChen-007
• https://api.github.com/users/YLChen-007/gists%7B/gist_id%7D
• https://api.github.com/users/YLChen-007/repos
• https://avatars.githubusercontent.com/u/30854794?v=4
• https://api.github.com/users/YLChen-007/events%7B/privacy%7D