CVE-2026-28482: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28482 is a path traversal vulnerability in OpenClaw (npm package) affecting versions prior to 2026.2.12 (specifically <= 2026.2.9). The flaw allows authenticated attackers to read or write arbitrary files outside the intended agent sessions directory by supplying unsanitized path traversal sequences (e.g., ../../etc/passwd) in sessionId or sessionFile parameters during transcript file operations. It was published on March 5, 2026, with patches released in version 2026.2.12. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). OpenClaw's gateway constructs transcript file paths by directly concatenating user-supplied sessionId and sessionFile parameters without validating for path separators, traversal sequences (../), or enforcing that the resolved path remains within the agent sessions directory. The fix introduced a validateSessionId() function enforcing a strict allowlist regex (/^[a-z0-9][a-z0-9._-]{0,127}$/i) and a resolvePathWithinSessionsDir() function that resolves and checks the candidate path relative to the sessions directory base, throwing an error if the result escapes the boundary. Exploitation requires the attacker to authenticate to the gateway (via gateway token or password); by default the gateway binds to loopback, but network-exposed configurations significantly widen the attack surface (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to read sensitive system files (e.g., /etc/passwd, private keys, configuration files) or write arbitrary content to locations outside the sessions directory, potentially enabling privilege escalation or persistent backdoor placement. The vulnerability has high confidentiality and integrity impact with no availability impact, and is scoped to the local system running the OpenClaw gateway. While lateral movement is not directly enabled, writing malicious files to sensitive locations (e.g., cron directories, SSH authorized_keys) could facilitate further compromise (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. The attack vector is local (AV:L), requiring prior authentication to the gateway, which limits opportunistic exploitation but does not eliminate risk in multi-tenant or network-exposed deployments (Feedly, GitHub Advisory).

1. Authenticate to the gateway: Obtain valid gateway credentials (token or password) through legitimate access, credential theft, or brute force against an exposed OpenClaw gateway endpoint.
2. Identify vulnerable version: Confirm the target is running OpenClaw <= 2026.2.9 (npm package) by inspecting version metadata or error responses.
3. Craft a malicious sessionId or sessionFile parameter: Construct a request to a gateway endpoint that performs transcript file operations (e.g., chat.inject or session listing), supplying a traversal payload such as sessionId=../../etc/passwd or sessionFile=../../etc/shadow.
4. Trigger file read: Send the crafted request; the gateway will resolve the path without sanitization, causing it to read the targeted file outside the sessions directory and potentially return its contents in the response.
5. Trigger file write (optional): Supply a traversal path in the sessionFile parameter targeting a writable sensitive location (e.g., a cron job directory or SSH config), and inject malicious content via the transcript write operation to achieve persistence or privilege escalation (GitHub Advisory, Patch Commit).

• Logs: Application logs showing transcript file operations with sessionId or sessionFile values containing ../, ..\, or absolute paths (e.g., /etc/passwd, /etc/shadow) outside the sessions directory; errors such as Session file path must be within sessions directory in logs may indicate blocked attempts post-patch.
• File System: Unexpected new or modified files outside the OpenClaw agent sessions directory (e.g., in /etc/, /var/spool/cron/, ~/.ssh/) with timestamps correlating to gateway activity; missing or altered sensitive system files.
• Network: Unusual authenticated requests to the OpenClaw gateway from unexpected source IPs, particularly if the gateway is network-exposed rather than loopback-only; repeated requests with encoded traversal sequences (%2e%2e%2f, %2e%2e/) in parameters.
• Process: Unexpected file I/O by the OpenClaw Node.js process to paths outside its designated data directories, observable via tools like auditd, inotifywait, or strace.

Upgrade OpenClaw (npm) to version 2026.2.12 or later, which validates session IDs against a strict allowlist regex and enforces sessions-directory containment for all transcript file path operations. The fix is implemented in commits 4199f98 (primary hardening) and cab0abf (additional hardening for cross-agent path resolution). For systems unable to patch immediately: restrict gateway authentication to trusted users only, ensure the gateway binds to loopback (default) rather than network interfaces, implement a web application firewall or reverse proxy to block requests containing path traversal sequences (../, ..\, %2e%2e) in parameters, and monitor application logs for anomalous file path values (GitHub Advisory).

The vulnerability was reported by researcher @akhmittra and credited in the GitHub Security Advisory and changelog. The advisory was published by maintainer steipete on February 16, 2026. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory and standard CVE aggregator coverage has been identified (GitHub Advisory).