High severity7.1NVD Advisory· Published Apr 9, 2026· Updated Apr 15, 2026
CVE-2026-35632
CVE-2026-35632
Description
OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | <= 2026.2.22 | — |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/openclaw/openclaw/security/advisories/GHSA-7xr2-q9vf-x4r5nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-7xr2-q9vf-x4r5ghsaADVISORY
- github.com/advisories/GHSA-fgvx-58p6-gjwcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-35632ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-symlink-traversal-via-identity-md-appendfile-in-agents-create-updatenvdThird Party AdvisoryWEB
- github.com/openclaw/openclaw/blob/main/src/gateway/server-methods/agents.tsghsaWEB
- github.com/openclaw/openclaw/blob/main/src/gateway/server-methods/agents.tsghsaWEB
- github.com/openclaw/openclaw/blob/main/src/gateway/server-methods/agents.tsghsaWEB
News mentions
0No linked articles in our index yet.