CVE-2026-26326 Details
Description
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved config values in `configChecks` for skill `requires.config` paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only `{ path, satisfied }`) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.
A vulnerability in OpenClaw's personal AI assistant, specifically in versions prior to 2026.2.14, allowed the `skills.status` feature to inadvertently disclose sensitive information to clients with `operator.read` access. This occurred by including unredacted configuration values in the `configChecks` for skills that required broad configuration paths, such as Discord channels. As a result, secrets like Discord bot tokens could be exposed. The issue has been addressed in version 2026.2.14, which removes the sensitive data from the `skills.status` checks and tightens the Discord token requirement.
Users should upgrade to OpenClaw version 2026.2.14 or later and rotate any Discord tokens that may have been exposed to clients with read access.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.2.14 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 23, 2026 | Initial Analysis | [email protected] |
| Feb 19, 2026 | New CVE Received | [email protected] |