Platform
nodejs
Component
openclaw
Fixed in
2026.2.18
CVE-2026-3689 is a Path Traversal vulnerability identified in OpenClaw, allowing for information disclosure. This flaw stems from insufficient validation of user-supplied paths within the canvas gateway endpoint, enabling attackers to access files they shouldn't. The vulnerability affects OpenClaw versions 2026.2.17 and earlier. A fix is expected to be released by the OpenClaw development team.
Successful exploitation of CVE-2026-3689 allows an authenticated attacker to read arbitrary files on the server hosting OpenClaw. This could expose sensitive configuration data, source code, or other confidential information. The potential impact is significant, as the attacker operates within the context of the service account, potentially granting access to resources beyond the immediate scope of the canvas gateway. This vulnerability shares similarities with other path traversal exploits, where improper input validation leads to unauthorized file access. The blast radius is limited to the server hosting OpenClaw and any resources accessible by the service account.
CVE-2026-3689 was reported to ZDI (ZDI-CAN-29312) and publicly disclosed on 2026-04-11. The vulnerability's severity is currently assessed as Medium. No public proof-of-concept exploits are currently known, but the ease of exploitation associated with path traversal vulnerabilities suggests a potential for rapid exploitation if a PoC is released. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.28% (51% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-3689 is to upgrade to a patched version of OpenClaw. Until a patch is available, consider implementing temporary workarounds. These may include restricting access to the canvas gateway endpoint to trusted users or networks. Implement strict input validation on the path parameters, ensuring they conform to expected patterns and do not contain malicious characters like '..' or absolute paths. Monitoring access logs for unusual file access attempts can also help detect potential exploitation. After upgrading, confirm the vulnerability is resolved by attempting to access a restricted file via the canvas gateway endpoint and verifying access is denied.
Update OpenClaw to the patched version to mitigate the path traversal vulnerability. Verify and strengthen user path validation in the source code to prevent future attacks. Implement strict access controls to limit access to sensitive files.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-3689 is a vulnerability in OpenClaw versions 2026.2.17 and earlier that allows attackers to disclose sensitive information by manipulating file paths. It's classified as a Path Traversal vulnerability with a Medium severity rating.
If you are running OpenClaw version 2026.2.17 or earlier, you are potentially affected by this vulnerability. Check your OpenClaw version and upgrade as soon as a patch is available.
The recommended fix is to upgrade to a patched version of OpenClaw. Until a patch is available, implement temporary workarounds like restricting access and validating input parameters.
As of the current assessment, there are no confirmed reports of active exploitation. However, due to the nature of path traversal vulnerabilities, exploitation is possible if a public proof-of-concept is released.
Refer to the OpenClaw project's official website and security advisories for the latest information and updates regarding CVE-2026-3689.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.