PT-2026-20960 · Openclaw · Openclaw

Simecek · Published 2026-02-17 · Updated 2026-03-01 · CVE-2026-26326

Positive Technologies · (AI Summary)

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14

Description The skills.status function could reveal sensitive information to clients with operator.read access. This occurred because the function returned raw resolved config values within configChecks for skill requires.config paths. Specifically, the configChecks[].value element in the requirements report could expose secrets, such as Discord bot tokens, if a skill required a broad configuration subtree. The function is accessible via operator.read, allowing clients with read-only access to obtain secrets without needing operator.admin or config.* permissions. The API endpoint involved is skills.status. The vulnerable parameter is requires.config.

Recommendations Upgrade to OpenClaw version 2026.2.14 or later. Rotate any Discord tokens that may have been exposed to read-scoped clients.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-26326

GHSA-8MH7-PHF8-XGFM

Affected Products

Openclaw

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26326.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8mh7-phf8-xgfm · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d3428053d95eefbe10ecf04f92218ffcba55ae5a · Patch
• https://github.com/openclaw/openclaw/commit/ebc68861a61067fc37f9298bded3eec9de0ba783 · Patch
• https://osv.dev/vulnerability/CVE-2026-26326 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8mh7-phf8-xgfm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26326 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://t.me/cveNotify/152856 · Telegram Post
• https://t.me/CVEtracker/45206 · Telegram Post
• https://twitter.com/masri_ram/status/2026047083006898432 · Twitter Post
• https://twitter.com/masri_ram/status/2025702592538407188 · Twitter Post
• https://twitter.com/CoyoteSecure/status/2028211943627256241 · Twitter Post
• https://twitter.com/DejaegherJeff/status/2024907748245176574 · Twitter Post