CVE-2026-26329 describes a path traversal vulnerability in OpenClaw, an AI assistant, prior to version 2026.2.14. Authenticated attackers can read arbitrary files from the Gateway host by supplying absolute or path traversal sequences to the browser tool's upload action. This vulnerability is rated Medium severity with a CVSS score of 6.5, indicating a network attack vector with low complexity, requiring authenticated access, and resulting in high confidentiality impact. While not currently listed in CISA's KEV catalog, the vulnerability has garnered some community discussion and media coverage, suggesting awareness within the cybersecurity community. There is no public exploit code available in Metasploit, Nuclei, or ExploitDB at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2026.2.14CPE matchmatch criteria | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.