CVE-2026-53856 — MEDIUM (5.5)

Vulnerability Description

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Openclaw	Openclaw	2026.4.23

Related Weaknesses (CWE)

CWE-732

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-rwp6-7w3q-75fqVendor Advisory
https://www.vulncheck.com/advisories/openclaw-insecure-file-permissions-in-confiThird Party Advisory

FAQ

What is CVE-2026-53856?

CVE-2026-53856 is a vulnerability with a CVSS score of 5.5 (MEDIUM). OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts ca...

How severe is CVE-2026-53856?

CVE-2026-53856 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-53856?

Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.