CVE-2026-35632 | BDVDB-2026-326137 Detail

Description#

OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-09Record published in the CVE List.
2. Version 22026-10-29Most recent update recorded in the CVE List.