CVE-2026-26326
OpenClaw skills.status could leak secrets to operator.read clients
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only { path, satisfied }) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
OpenClaw skills.status could leak secrets to operator.read clients
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only { path, satisfied }) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.
- Record
CVE-2026-26326- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2026-8422
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only { path, satisfied }) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.
- Record
EUVD-2026-8422- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8mh7-phf8-xgfm
OpenClaw skills.status could leak secrets to operator.read clients
Summary
skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.13 - Patched:
2026.2.14
Details
The gateway method skills.status returned a requirements report that included configChecks[].value (the resolved value for each requires.config entry). If a skill required a broad config subtree (for example channels.discord), the report could include secrets such as Discord bot tokens.
skills.status is callable with operator.read, so read-scoped clients could obtain secrets without operator.admin / config.* access.
Fix
- Stop including raw resolved config values in requirement checks (return only
{ path, satisfied }). - Narrow the Discord skill requirement to the token key.
Fix commit(s):
- d3428053d95eefbe10ecf04f92218ffcba55ae5a
- ebc68861a61067fc37f9298bded3eec9de0ba783
Mitigation
Rotate any Discord tokens that may have been exposed to read-scoped clients.
Thanks @simecek for reporting.
Fix commits d3428053d95eefbe10ecf04f92218ffcba55ae5a and ebc68861a61067fc37f9298bded3eec9de0ba783 confirmed on main and in v2026.2.14. Upgrade to openclaw >= 2026.2.14.
- Record
GHSA-8mh7-phf8-xgfm- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only { path, satisfied }) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.
- Record
CVE-2026-26326- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
OpenClaw skills.status could leak secrets to operator.read clients
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only { path, satisfied }) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.
- Record
CVE-2026-26326- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-8mh7-phf8-xgfm
OpenClaw skills.status could leak secrets to operator.read clients
Summary
skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.13 - Patched:
2026.2.14
Details
The gateway method skills.status returned a requirements report that included configChecks[].value (the resolved value for each requires.config entry). If a skill required a broad config subtree (for example channels.discord), the report could include secrets such as Discord bot tokens.
skills.status is callable with operator.read, so read-scoped clients could obtain secrets without operator.admin / config.* access.
Fix
- Stop including raw resolved config values in requirement checks (return only
{ path, satisfied }). - Narrow the Discord skill requirement to the token key.
Fix commit(s):
- d3428053d95eefbe10ecf04f92218ffcba55ae5a
- ebc68861a61067fc37f9298bded3eec9de0ba783
Mitigation
Rotate any Discord tokens that may have been exposed to read-scoped clients.
Thanks @simecek for reporting.
Fix commits d3428053d95eefbe10ecf04f92218ffcba55ae5a and ebc68861a61067fc37f9298bded3eec9de0ba783 confirmed on main and in v2026.2.14. Upgrade to openclaw >= 2026.2.14.
- Record
GHSA-8mh7-phf8-xgfm- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openclawnpm | before 2026.2.14 | 2026.2.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-26326 is a medium vulnerability (CVSS 5.3) in Openclaw, published February 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in openclaw 2026.2.14.
References
github.com/openclaw/openclaw/security/advisories/GHSA-8mh7-phf8-xgfm
nvd.nist.gov/vuln/detail/CVE-2026-26326