p PatchFirst

CVE-2026-26326

CVE-2026-26326 · OpenClaw skills.status could leak secrets to operator.read clients

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved config values in `configChecks` for skill `requires.config` paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only `{ path, satisfied }`) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • < 2026.2.14: Affected

    No fix published

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.2.14

    Update to 2026.2.14

Original sources

Check your server →