CVE-2026-26329: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26329 is a path traversal vulnerability in OpenClaw, a personal AI assistant, that allows authenticated attackers to read arbitrary files from the Gateway host. By supplying absolute paths or path traversal sequences to the browser tool's upload action, attackers can cause the server to pass unvalidated paths to Playwright's setInputFiles() APIs, enabling local file disclosure. All versions prior to 2026.2.14 of the openclaw npm package are affected. The vulnerability was disclosed on February 15, 2026, and carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (Github Advisory, OpenClaw Security Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerability exists in two entry points: POST /tools/invoke with {"tool":"browser","action":"upload",...} and POST /hooks/file-chooser. In both cases, user-supplied file paths were passed directly to Playwright's setInputFiles() API without being validated or confined to a safe directory root (DEFAULT_UPLOAD_DIR). Once Playwright reads the referenced file from the local filesystem and attaches it to a page-level file input, the file contents can be exfiltrated via page JavaScript (e.g., using FileReader) or through agent/browser snapshots. Exploitation requires authenticated access (valid bearer token or password), the browser tool to be permitted by tool policy, and browser support to be enabled (Github Advisory, OpenClaw Security Advisory).

Successful exploitation results in arbitrary local file read on the Gateway host, with a high confidentiality impact and no integrity or availability impact. An authenticated attacker can access sensitive files anywhere on the host filesystem — including credentials, configuration files, private keys, or other sensitive data — by crafting traversal paths such as ../../etc/passwd or absolute paths like /etc/shadow. The severity escalates significantly if the Gateway is exposed beyond loopback (e.g., on a LAN, tailnet, via reverse proxy, or tunnels), as this broadens the attacker pool from local/authenticated users to any network-reachable authenticated party (Github Advisory, OpenClaw Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.055% (0.018% per GitHub Advisory), placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation is constrained by the requirement for valid Gateway authentication and browser tool access, limiting the attacker pool; however, in default setups the onboarding wizard generates a gateway token even for loopback, which may lower the practical barrier for local attackers.

1. Obtain Gateway credentials: Acquire a valid Gateway bearer token or password. In default loopback-bound setups, the onboarding wizard generates a gateway token that may be accessible locally.
2. Identify the target endpoint: Confirm the Gateway HTTP surface is reachable (default: loopback; higher risk if exposed on LAN/tailnet/reverse proxy) and that the browser tool is permitted by the session's tool policy.
3. Craft a malicious upload request: Send a POST request to /tools/invoke or /hooks/file-chooser with a path traversal payload, e.g.:

   POST /tools/invoke
   Authorization: Bearer <token>
   Content-Type: application/json
   
   {"tool":"browser","action":"upload","path":"/etc/passwd"}

   or using traversal sequences such as ../../../../etc/shadow.
4. Trigger Playwright file read: The server passes the unvalidated path to Playwright's setInputFiles(), which reads the file from the local filesystem and attaches it to a page-level file input element.
5. Exfiltrate file contents: The attached file's contents can be read via page JavaScript (e.g., FileReader API) or extracted through agent/browser snapshots returned in the API response (Github Advisory, OpenClaw Security Advisory).

• Network: Unusual authenticated POST requests to /tools/invoke or /hooks/file-chooser Gateway endpoints containing absolute paths (e.g., /etc/passwd, /root/.ssh/id_rsa) or path traversal sequences (../, ..\) in the request body.
• Logs: Gateway access logs showing repeated or anomalous POST /tools/invoke or POST /hooks/file-chooser requests with browser/upload action parameters referencing paths outside /tmp/openclaw/uploads; authentication events from unexpected source IPs if Gateway is exposed beyond loopback.
• Process: Playwright browser process reading files outside the expected temp uploads directory (/tmp/openclaw/uploads or ${os.tmpdir()}/openclaw/uploads); unexpected file access patterns by the OpenClaw Node.js process to sensitive system files.

The primary remediation is to upgrade OpenClaw to version 2026.2.14 or later, which confines upload paths to DEFAULT_UPLOAD_DIR (/tmp/openclaw/uploads) and rejects traversal or escape paths (fix commit: 3aa94af) (OpenClaw Release). If immediate patching is not possible, restrict Gateway access to loopback only (avoid LAN/tailnet/reverse proxy exposure), enforce restrictive tool policies to limit browser tool access, and rotate or restrict Gateway tokens. Monitor authentication logs for suspicious access patterns targeting the browser upload endpoints (Github Advisory).

The vulnerability was part of a broader batch of over 60 security issues resolved in OpenClaw version 2026.2.14, which attracted notable coverage from security media and researchers (BeyondMachines, Infosecurity Magazine). Endor Labs published a technical write-up on how AI-assisted SAST tooling was used to trace data flows and uncover six OpenClaw vulnerabilities, including this one (Endor Labs). A related "ClawJacked" attack scenario — where malicious websites hijack local OpenClaw AI agents via WebSocket — received significant coverage in The Hacker News and developer communities, raising broader awareness of OpenClaw's attack surface (The Hacker News). SOS Intelligence featured CVE-2026-26329 in multiple weekly CVE chatter top-ten lists, indicating sustained community interest.