VulnSocial

CVE-2026-35632Disclosure(openclaw / openclaw)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.

openclaw CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-61

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-04-09); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-09: 2Mentions · 2026-04-10: 1Technical Details · 2026-04-09: 2Technical Details · 2026-04-10: 104-0904-10
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-092
Disclosure2
2026-04-101
Disclosure1
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-35632 Symlink Traversal and Remote Code Execution in OpenClaw Through 2026.2.22 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35632

    Post summary

    The text announces a symlink traversal and remote code execution vulnerability in OpenClaw (CVE‑2026‑35632), but provides no further information on patches, exploitation, or active attacks.

    0000058
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-35632 OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlin… https://www.cve.org/CVERecord?id=CVE-2026-35632 ----- Traducción: CVE-20… http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-35632, describing a symlink traversal flaw in OpenClaw's file handling, but offers no PoC, exploit code, or patch details.

    0000040
    67 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-35632 OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlin… https://www.cve.org/CVERecord?id=CVE-2026-35632

    Post summary

    A disclosure of a symlink traversal flaw in OpenClaw (up to 2026.2.22) is presented, but no PoC, exploit code, active exploitation, patch, or debunking information is included.

    00000192
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities