GHSA-56pc-6hvp-4gv4: OpenClaw vulnerable to arbitrary file read via $include directive

March 3, 2026

A successful exploit can expose local secrets and credentials readable by the OpenClaw process user, including API keys and private config material.

References

github.com/advisories/GHSA-56pc-6hvp-4gv4
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/d1c00dbb7c64a39e205464dae7f2a068420e91c1
github.com/openclaw/openclaw/security/advisories/GHSA-56pc-6hvp-4gv4

Code Behaviors & Features

Detect and mitigate GHSA-56pc-6hvp-4gv4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →