CVE-2026-26326: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26326 is an information disclosure vulnerability in OpenClaw, a personal AI assistant, where the skills.status endpoint leaks sensitive configuration secrets to clients holding only operator.read permissions. Affected versions are all releases prior to 2026.2.14 (npm package openclaw <= 2026.2.13). The vulnerability was reported by researcher @simecek, disclosed via GitHub Security Advisory on February 15, 2026, and published to the NVD on February 19, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The gateway method skills.status constructed a requirements report that included configChecks[].value — the raw, fully resolved value for each requires.config entry. When a skill declared a dependency on a broad config subtree (e.g., channels.discord), the resolved value could contain secrets such as Discord bot tokens. Because skills.status is callable by any client with the operator.read scope — a lower-privilege role that does not require operator.admin or config.* access — authenticated but unprivileged clients could retrieve these secrets over the network without any additional exploitation steps (GitHub Advisory, OpenClaw Advisory).

Successful exploitation allows a low-privileged, authenticated client with operator.read scope to retrieve sensitive secrets — including Discord bot tokens and potentially other API keys — that are stored in the OpenClaw configuration. Exposed tokens could be used for unauthorized access to integrated third-party services (e.g., Discord bots), enabling impersonation, data exfiltration from those platforms, or further lateral movement within connected services. There is no integrity or availability impact on the OpenClaw system itself (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid operator.read credential, limiting the attack surface to authenticated clients (GitHub Advisory).

1. Obtain operator.read credentials: Acquire a valid API token or session credential scoped to operator.read on a target OpenClaw instance running version <= 2026.2.13.
2. Call the skills.status endpoint: Issue an authenticated request to the OpenClaw gateway method skills.status (e.g., via the gateway API or CLI with the read-scoped token).
3. Extract secrets from the response: Parse the returned configChecks[] array in the response body; each entry includes a value field containing the raw resolved configuration value. For skills with broad config dependencies (e.g., channels.discord), this value will include secrets such as Discord bot tokens.
4. Abuse extracted credentials: Use the harvested tokens to authenticate to integrated third-party services (e.g., Discord API) for unauthorized actions such as reading messages, sending messages as the bot, or accessing guild data (GitHub Advisory, OpenClaw Advisory).

• Logs: Unusual or repeated calls to the skills.status gateway method from clients that do not normally invoke it; access log entries showing operator.read-scoped tokens querying status endpoints at unexpected times or frequencies.
• Network: Outbound API calls to Discord (e.g., discord.com/api) or other integrated services originating from unexpected sources or IP addresses not associated with the OpenClaw host, potentially indicating token abuse after exfiltration.
• Application: Evidence of operator.read tokens being used from IP addresses or user agents inconsistent with legitimate operator clients.

Upgrade the openclaw npm package to version 2026.2.14 or later, which resolves the issue by removing raw config values from skills.status responses (returning only { path, satisfied }) and narrowing the Discord skill requirement to the token key only (GitHub Advisory, Release Notes). As an immediate remediation step regardless of upgrade status, rotate any Discord tokens (and other API keys) that may have been accessible to operator.read-scoped clients. Additionally, review and restrict which clients and users are granted operator.read permissions to minimize exposure.

The vulnerability was reported by community researcher @simecek and analyzed by stanislavfortaisle, reflecting active community security engagement with the OpenClaw project (OpenClaw Advisory). The release of version 2026.2.14 addressed over 60 security issues simultaneously, which was noted in security digest coverage (BeyondMachines). No significant broader media coverage or notable researcher commentary specific to this CVE has been identified.