CVE-2026-28462: Openclaw

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST /trace/stop, POST /wait/download, and POST /download endpoints to write files outside intended temp roots.

Affected products

• Openclaw Openclaw: before 2026.2.13 (fixed in 2026.2.13)

Published 2026-03-05. Last modified 2026-06-17.