Git · Openclaw · CVE-2026-32061
**Name of the Vulnerable Software and Affected Versions**
OpenClaw versions prior to 2026.2.17
**Description**
OpenClaw versions prior to 2026.2.17 contain a path traversal flaw in the `$include` directive resolution. This allows reading arbitrary local files outside the configuration directory boundary. An attacker with the ability to modify OpenClaw configuration files can exploit this by specifying absolute paths, traversal sequences, or symbolic links to access sensitive files readable by the OpenClaw process user, including API keys and credentials. The impact is limited by the file permissions of the OpenClaw runtime user. The vulnerability exists due to improper handling of the `$include` directive.
**Recommendations**
Update OpenClaw to version 2026.2.17 or later.