Executive Summary

CVE-2026-53865 is a path traversal vulnerability in OpenClaw versions before 2026.5.2 that affects maintenance task execution. It allows attackers to manipulate workspace-derived service paths to influence which trash command is selected. This manipulation can cause unintended local executables from paths not intended by the operator to be executed during maintenance operations.

Essentially, by controlling environment paths derived from the workspace, an attacker can cause the system to run unauthorized commands, potentially leading to arbitrary command execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized execution of local executables from unintended paths during maintenance tasks. This means an attacker with some level of access could execute arbitrary commands, potentially compromising system integrity.

The impact depends on the operator's configuration and whether lower-trust inputs can influence the workspace-derived paths. While the trusted-operator model of OpenClaw remains intact, exploitation could allow malicious code execution if security boundaries are crossed.

• Potential unauthorized command execution
• Compromise of maintenance operations
• Execution of unintended local executables

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-53865 vulnerability in OpenClaw prior to version 2026.5.2, you should take the following immediate steps:

• Keep maintenance flows restricted to trusted workspaces to prevent untrusted input from influencing service paths.
• Use fixed service paths instead of workspace-derived paths to avoid path traversal issues.
• Narrow channel and tool allowlists to limit which executables and commands can be run during maintenance tasks.
• Avoid sharing Gateways between untrusted users to reduce the risk of unauthorized path manipulation.
• Disable the affected maintenance task feature if it is not necessary in your environment.
• Upgrade OpenClaw to version 2026.5.2 or later, where this vulnerability has been patched.

Useful 0 Not Useful 0