Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path outside the sessions directory to create files and append data repeatedly, potentially causing configuration corruption or denial of service.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28459 OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary loc… https://www.cve.org/CVERecord?id=CVE-2026-28459
Post summary
OpenClaw before version 2026.2.12 has a path‑validation flaw that permits authenticated gateway clients to write transcript data to arbitrary locations.
CVE Alert: CVE-2026-28459 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-28459-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-28459 #openclaw #
Post summary
The post announces CVE-2026-28459 affecting OpenClaw and links to an external alert for details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |