CVE-2026-27488

This vulnerability allows an attacker with local access to the system to potentially view sensitive information due to a flaw in how the software checks for file existence. To exploit this issue, the attacker must be able to run code on the affected version of OpenClaw, so it's important to upgrade to the latest version to fix the problem.

An attacker can remotely inject malicious code into the OpenClaw application due to a flaw in its Skill Env Handler. To exploit this vulnerability, the attacker needs to manipulate specific configurations, making it crucial to upgrade to the latest version to protect against this risk.

An attacker can exploit a vulnerability in OpenClaw to inject and execute arbitrary commands with the same permissions as the OpenClaw service user, potentially taking control of the system. This requires the attacker to manipulate specific environment variables and trigger a service installation or restart.

This vulnerability allows an attacker to read sensitive files on the server, such as API keys and credentials, by manipulating file paths in the OpenClaw application. To exploit this, the attacker must have the ability to modify configuration settings within OpenClaw.

This vulnerability allows attackers to write or delete files on the server outside of the designated workspace, which can lead to unauthorized changes or data loss. It occurs when the apply_patch feature is enabled without proper security measures in place, allowing attackers to manipulate file paths to escape the intended directory.