CVE-2026-81720

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

EUVD-2026-67070

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81720

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter found in identity file protection blocks. Because the value is passed unboundedly into Argon2 key derivation, an attacker with write access to local identity stores can craft a malicious identity file with an excessive memor...

CVE-2026-81720 openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

GHSA-PMF3-2Q63-JMP6 Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7xr2-q9vf-x4r5. This link is maintained to preserve external references. Original Description OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers tha...

CVE-2026-35632 OpenClaw <= 2026.2.22 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update

OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files,...

CVE-2026-35632

OpenClaw before 2026.2.22 is affected by a symlink traversal in agents.create and agents.update that uses fs.appendFile on IDENTITY.md without proper symlink containment checks. With workspace access, an attacker can plant symlinks to append attacker-controlled content to arbitrary files, enablin...

CVE-2026-35632

OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files,...

PT-2026-31767

Name of the Vulnerable Software and Affected Versions OpenClaw versions through 2026.2.22 Description OpenClaw through version 2026.2.22 has a symlink traversal issue in the agents.create and agents.update handlers. These handlers use fs.appendFile on IDENTITY.md without proper symlink containmen...

OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Summary The patch for CVE-2026-32013 introduced symlink resolution and workspace boundary enforcement for agents.files.get and agents.files.set. However, two other handlers in the same file agents.create and agents.update still use raw fs.appendFile on the IDENTITY.md file without any symlink...

GHSA-7XR2-Q9VF-X4R5 OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Summary The patch for CVE-2026-32013 introduced symlink resolution and workspace boundary enforcement for agents.files.get and agents.files.set. However, two other handlers in the same file agents.create and agents.update still use raw fs.appendFile on the IDENTITY.md file without any symlink...