Openclaw cli: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability (CVE-2026-3689)

The OpenClaw gateway's canvas tool accepts an a2ui_push action with a jsonlPath parameter that specifies a filesystem path to read. The gateway reads this file using fs.readFile() without any path validation, canonicalization, or directory restriction. An authenticated attacker can supply an arbitrary absolute or relative path to read any file accessible to the gateway process. The file contents are forwarded to the connected node client via a WebSocket command. The vulnerability is due to the lack of allowlist, canonicalization, or directory traversal checks in the code handling jsonlPath. This allows an attacker with gateway token access to read sensitive files such as /etc/passwd or private keys and exfiltrate them.

An authenticated attacker with access to the gateway token can read arbitrary files on the gateway host, including sensitive system files and credentials. This leads to information disclosure that could facilitate further attacks or compromise of the system. The vulnerability does not require user interaction beyond authentication and can be exploited via crafted API requests. The gateway confirms successful file reads, and contents are sent to connected node clients, enabling data exfiltration.

A patch is available for this vulnerability. Users should update OpenClaw to version 2026.7.1 or later to remediate this issue. Until patched, restrict access to the gateway token and avoid exposing the canvas tool's a2ui_push action to untrusted users. Do not rely on the gateway's current implementation for file path validation or restriction.