PT-2026-49773 · Openclaw · Openclaw

Kaze310 · Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-53856

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.23 through 2026.4.23

Description An insecure file permissions issue exists in the config recovery process that restores the OpenClaw.json file with overly broad permissions. Local attackers on shared hosts can exploit the recovery path to read sensitive configuration data from the restored file.

Recommendations Update to version 2026.4.24.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2026-53856

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rwp6-7w3q-75fq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53856 · Security Note
• https://vulncheck.com/advisories/openclaw-insecure-file-permissions-in-config-recovery-via-openclaw-json · Note