CVE-2026-53856CWE-732

OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json

Medium · published June 16, 2026

CVSS v4.0
5.7
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00136 · 2.8th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-06-16T18:05Z
EPSS history
Timeline
  • 16 JUN 18:05Z
    OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json
    cvelistv5