CVE-2026-53856

OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json

Published Jun 16, 2026 CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Description

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file.

Analysis

Technical impact

OpenClaw 2026.4.23 and earlier suffer from an insecure file permissions vulnerability during configuration recovery. When the recovery process restores the OpenClaw.json file, the permissions applied allow any local user on a shared host to read the file. This permits an attacker to gain access to sensitive configuration data, potentially revealing credentials, API keys, or other secrets. The weakness originates from improper file permission handling (CWE-732).

Affected Systems

This vulnerability affects all installations of OpenClaw using versions 2026.4.23 or earlier. Updating to 2026.4.24 or later eliminates the issue.

Risk and Exploitability

With a CVSS score of 5.7 the vulnerability presents moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation. It is not currently listed in CISA's KEV catalog. The attack is local; an attacker who can run code or trigger the recovery path on a shared system can read the restored OpenClaw.json file and extract confidential data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`2026.4.23`	affected	< 2026.4.24
`2026.4.24`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:2026.4.23:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[2026.4.23,2026.4.24)`	affected	semver	['node.js']
`2026.4.24`	unaffected	semver	['node.js']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to OpenClaw 2026.4.24 or later
If updating immediately is not possible, restrict the permissions of the restored OpenClaw.json file to the owner only (chmod 600) to prevent other local users from reading it
If the instance runs on a shared host, consider moving it to an isolated environment or container with non-shared volumes to eliminate local file system access

Generated by OpenCVE AI on June 17, 2026 at 22:27 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rwp6-7w3q-75fq	OpenClaw: Config recovery could restore openclaw.json with broad file permissions

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.094% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/openclaw/security/advisories/GHSA-rwp6-7w3q-75fq
https://www.vulncheck.com/advisories/openclaw-insecure-file-permissions-in-config-recovery-via-openclaw-json

History

Jun 16, 2026 8:45 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file.	OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file.
Title	OpenClaw < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json	OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json

Jun 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 6:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file.
Title		OpenClaw < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-732
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/security/advisories/GHSA-rwp6-7w3q-75fq https://www.vulncheck.com/advisories/openclaw-insecure-file-permissions-in-config-recovery-via-openclaw-json
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 5.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`