CVE-2026-32061: OpenClaw Path Traversal Vulnerability

CVE-2026-32061 Overview

OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config directory boundary. Attackers with config modification capabilities can exploit this by specifying absolute paths, traversal sequences, or symlinks to access sensitive files readable by the OpenClaw process user, including API keys and credentials.

Critical Impact

Attackers with configuration modification access can read sensitive local files including API keys and credentials by exploiting improper path validation in the $include directive.

Affected Products

• OpenClaw versions prior to 2026.2.17

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-32061 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32061

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal) and affects the $include directive processing within OpenClaw's configuration system. The flaw stems from insufficient validation of include paths, allowing attackers to escape the intended configuration directory boundary through multiple attack vectors.

When processing configuration files, OpenClaw resolves $include directives without adequately verifying that the resolved path remains within the designated config directory. This lack of path confinement enables three distinct exploitation methods: absolute path specification, directory traversal sequences (e.g., ../), and symbolic link resolution that points outside the config boundary.

The vulnerability requires local access and elevated privileges, as the attacker must have the ability to modify OpenClaw configuration files. Upon successful exploitation, an attacker can read any file accessible to the OpenClaw process user, potentially exposing sensitive credentials, API keys, and other confidential data.

Root Cause

The root cause is inadequate input validation and path confinement in the $include directive resolution logic. The original implementation failed to verify that included file paths remain within the configuration directory boundary before reading and processing the included content. The vulnerability existed because the path resolution did not employ proper canonicalization or containment checks to prevent directory escape.

Attack Vector

The attack requires local access with high privileges (configuration modification capabilities). An attacker can craft malicious configuration entries using the $include directive with:

• Absolute paths pointing to sensitive files (e.g., $include: /etc/passwd)
• Relative paths with traversal sequences (e.g., $include: ../../../etc/shadow)
• Symlinks within the config directory pointing to external sensitive files

When OpenClaw processes the crafted configuration, it reads the contents of the specified file and includes them in the configuration context, effectively disclosing the file contents to the attacker.

The security patch introduces the isPathInside function from ../security/scan-paths.js to validate that resolved include paths remain confined within the config directory:

import fs from "node:fs";
import path from "node:path";
import JSON5 from "json5";
+import { isPathInside } from "../security/scan-paths.js";
import { isPlainObject } from "../utils.js";

export const INCLUDE_KEY = "$include";

Source: GitHub Commit Details

Additionally, the patch adds diagnostic warnings through the doctor-config-flow to alert users when include paths violate confinement rules:

+function noteIncludeConfinementWarning(snapshot: {
+  path?: string | null;
+  issues?: Array<{ message: string }>;
+}): void {
+  const issues = snapshot.issues ?? [];
+  const includeIssue = issues.find(
+    (issue) =>
+      issue.message.includes("Include path escapes config directory") ||
+      issue.message.includes("Include path resolves outside config directory"),
+  );
+  if (!includeIssue) {
+    return;
+  }
+  const configRoot = path.dirname(snapshot.path ?? CONFIG_PATH);
+  note(
+    [
+      `- $include paths must stay under: ${configRoot}`,
+      '- Move shared include files under that directory and update to relative paths like "./shared/common.json".',
+      `- Error: ${includeIssue.message}`,
+    ].join("\n"),
+    "Doctor warnings",
+  );
+}

Source: GitHub Commit Details

Detection Methods for CVE-2026-32061

Indicators of Compromise

• Configuration files containing $include directives with absolute paths or traversal sequences (../)
• Unexpected file read operations by the OpenClaw process targeting files outside the config directory
• OpenClaw configuration errors or warnings related to include path confinement violations
• Audit logs showing access to sensitive system files (e.g., /etc/passwd, credentials files) by the OpenClaw process

Detection Strategies

• Monitor file system access patterns for the OpenClaw process, alerting on reads outside expected directories
• Implement configuration file integrity monitoring to detect unauthorized modifications to $include directives
• Review OpenClaw logs for "Include path escapes config directory" or "Include path resolves outside config directory" messages
• Deploy SentinelOne Singularity to detect anomalous file access patterns indicative of path traversal exploitation

Monitoring Recommendations

• Enable detailed logging for configuration file parsing operations in OpenClaw
• Set up alerts for any configuration changes involving the $include directive
• Monitor for symlink creation within configuration directories that may indicate preparation for exploitation
• Implement file access auditing on sensitive files that could be targeted via this vulnerability

How to Mitigate CVE-2026-32061

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.17 or later immediately
• Review all existing configuration files for $include directives using absolute paths or traversal sequences
• Audit file permissions to restrict configuration modification capabilities to trusted administrators only
• Run the OpenClaw doctor command to identify any existing confinement violations in configurations

Patch Information

The vulnerability has been patched in OpenClaw version 2026.2.17. The fix introduces path confinement validation using the isPathInside() function and adds diagnostic warnings through the doctor-config-flow component. For detailed patch information, refer to the GitHub Security Advisory and the commit implementing the fix.

Workarounds

• Restrict configuration file modification access to only highly trusted administrators until patching is complete
• Remove or replace any $include directives that use absolute paths or traversal sequences with relative paths pointing to files within the config directory
• Implement file system permissions to prevent the OpenClaw process user from reading sensitive files outside intended directories
• Consider running OpenClaw in a containerized environment with restricted filesystem access as an additional defense layer

# Configuration example
# Update include directives to use relative paths within config directory
# Before (vulnerable):
# $include: /etc/secrets/api-keys.json
# $include: ../../../sensitive/credentials.json

# After (safe):
# $include: ./shared/api-keys.json
# $include: ./includes/common-config.json

# Verify configurations with OpenClaw doctor command
openclaw doctor --check-includes

# Restrict config directory permissions
chmod 750 /path/to/openclaw/config
chown openclaw:openclaw-admins /path/to/openclaw/config