CVE-2026-32061

This vulnerability allows an attacker with local access to the system to potentially view sensitive information due to a flaw in how the software checks for file existence. To exploit this issue, the attacker must be able to run code on the affected version of OpenClaw, so it's important to upgrade to the latest version to fix the problem.

An attacker can remotely inject malicious code into the OpenClaw application due to a flaw in its Skill Env Handler. To exploit this vulnerability, the attacker needs to manipulate specific configurations, making it crucial to upgrade to the latest version to protect against this risk.

An attacker can exploit a vulnerability in OpenClaw to inject and execute arbitrary commands with the same permissions as the OpenClaw service user, potentially taking control of the system. This requires the attacker to manipulate specific environment variables and trigger a service installation or restart.

This vulnerability allows attackers to write or delete files on the server outside of the designated workspace, which can lead to unauthorized changes or data loss. It occurs when the apply_patch feature is enabled without proper security measures in place, allowing attackers to manipulate file paths to escape the intended directory.

This vulnerability allows attackers to run unauthorized sort commands on OpenClaw systems by using shortened versions of command options, effectively bypassing security checks meant to prevent such actions. It requires the system to be in allowlist mode, where only approved commands should be executed, but the flaw lets attackers sneak around these restrictions.