PT-2026-26414 · Openclaw · Openclaw

Tdjackey · CVE-2026-32033 · Publicado 2026-03-03 · Atualizado 2026-03-20

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.24

Description OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability. Absolute paths with a '@' prefix bypass workspace-only file-system boundary validation due to a canonicalization mismatch. Attackers can exploit this by crafting @-prefixed paths, such as @/etc/passwd, to read files outside the intended workspace boundary when tools.fs.workspaceOnly is enabled. The issue occurs because certain @-prefixed absolute paths are validated before canonicalization, while runtime path handling normalizes the prefix differently, allowing reads outside the intended workspace boundary.

Recommendations Update OpenClaw to version 2026.2.24 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-180

CWE-22

Identificadores relacionados

CVE-2026-32033

GHSA-27CR-4P5M-74RJ

Produtos afetados

Openclaw

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32033.json · Exploit
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260 · Correção
• https://vulncheck.com/advisories/openclaw-path-traversal-via-prefixed-absolute-paths-in-workspace-boundary-validation · Nota
• https://osv.dev/vulnerability/GHSA-27cr-4p5m-74rj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32033 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32033 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034891583619829813 · Publicação no Twitter