5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26326

CVE-2026-26326: OpenClaw skills.status could leak secrets to operator.read clients

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only { path, satisfied }) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26326

CVE-2026-26326:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-8mh7-phf8-xgfm, allowed for the disclosure of sensitive configuration secrets to clients with limited operator.read permissions. The root cause was in the skills.status gateway method, which returned a detailed report on skill requirements.

The analysis of the provided patches reveals that the core of the issue lay within the buildConfigChecks function in src/shared/requirements.ts. This function was designed to check if configuration requirements were met, but it also resolved and returned the actual values of the configuration paths. This included potentially sensitive data, such as the Discord bot token mentioned in the advisory.

The call chain leading to the vulnerability started at the skills.status endpoint, which is handled by functions like buildSkillStatus. This function would call evaluateRequirementsFromMetadata, which in turn called evaluateRequirements, and finally buildConfigChecks. Along this chain, a function to resolve the configuration value (resolveConfigValue) was passed down, leading to the inclusion of the secret value in the final output.

The fix, implemented in commit d3428053d95eefbe10ecf04f92218ffcba55ae5a, involved removing the logic that resolved and returned the configuration values. Specifically, the value field was removed from the RequirementConfigCheck type, and the resolveValue parameter was removed from buildConfigChecks and its callers (evaluateRequirements, evaluateRequirementsFromMetadata, buildSkillStatus, and buildHookStatus).

A similar vulnerability was proactively fixed in buildHookStatus, which could have exposed secrets related to hooks.

By identifying these functions, runtime security tools can now monitor for calls to these vulnerable functions (in their unpatched versions) to detect potential exploitation attempts.

Vulnerable functions

buildSkillStatus

src/agents/skills-status.ts

The `buildSkillStatus` function was responsible for gathering the status of skills, including their configuration requirements. It previously called `evaluateRequirementsFromMetadata` with a `resolveConfigValue` function that would resolve the actual value of a configuration path. This led to the inclusion of potentially sensitive information, like API tokens, in the response of the `skills.status` API endpoint, which was accessible to lower-privileged users.

buildHookStatus

src/hooks/hooks-status.ts

Similar to `buildSkillStatus`, the `buildHookStatus` function had the same vulnerability. It passed a `resolveConfigValue` function to `evaluateRequirementsFromMetadata`, which could lead to the exposure of sensitive configuration values related to hooks. The patch removed this parameter to prevent the values from being resolved and returned.

buildConfigChecks

src/shared/requirements.ts

This function is the root cause of the information leak. It was responsible for constructing the configuration check objects. The vulnerable version of this function accepted a `resolveValue` function parameter, which it used to get the raw value of a configuration path and include it in the returned object. The fix removes the `resolveValue` parameter and the `value` field from the returned object, effectively redacting the sensitive information.

evaluateRequirements

src/shared/requirements.ts

This function acted as an intermediary, passing the `resolveConfigValue` function down to the `buildConfigChecks` function. The patch removed the `resolveConfigValue` parameter from this function's signature and from its call to `buildConfigChecks`, breaking the chain that led to the information disclosure.

evaluateRequirementsFromMetadata

src/shared/requirements.ts

This function, called by `buildSkillStatus` and `buildHookStatus`, was responsible for evaluating requirements from metadata. It passed the sensitive `resolveConfigValue` function to `evaluateRequirements`. The patch removed this parameter, preventing the config values from being resolved.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.