PT-2026-49773 · Openclaw · Openclaw

Kaze310

·

CVE-2026-53856

·

Published

2026-06-16

·

Updated

2026-06-18

CVSS v4.0

5.7

Medium

VectorAV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.23 through 2026.4.23
Description An insecure file permissions issue exists in the config recovery process that restores the OpenClaw.json file with overly broad permissions. Local attackers on shared hosts can exploit the recovery path to read sensitive configuration data from the restored file.
Recommendations Update to version 2026.4.24.

Exploit

Fix

Incorrect Permission

Incorrect Default Permissions

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-732CWE-276

Related Identifiers

CVE-2026-53856
GHSA-RWP6-7W3Q-75FQ
GHSA-VQJ9-VHG4-27MG

Affected Products

Openclaw