CVE-2026-53856
Description
OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file.
Summary dbcve.org
OpenClaw versions prior to 2026.4.24 have an insecure file permissions vulnerability in the config recovery functionality. When restoring the OpenClaw.json configuration file, the application saves it with overly broad (world-readable) permissions, allowing local attackers on shared hosting environments to read sensitive configuration data.
Mitigation
Upgrade to OpenClaw 2026.4.24 or later which fixes the file permissions issue. As a workaround, manually set restrictive permissions (e.g., chmod 600) on the OpenClaw.json file after recovery.