CVE-2026-59261: OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configur

highCVSS 7.1CVE-2026-59261

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.1
Published: 2026-07-08
Last updated: 2026-07-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59261

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-592610.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59261	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] OpenClaw: Multiple vulnerabilitiescert-bund

Recent advisories for OpenClaw

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-15193: A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element…nvd · 2026-07-09
high[UPDATE] [high] OpenClaw: Multiple vulnerabilitiescert-bund · 2026-07-09
highGHSA-p73f-w79w-jqr5: OpenClaw: Native command authorization could skip owner-command enforcementghsa · 2026-07-02
highGHSA-j472-gf56-x589: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checksghsa · 2026-07-02
highGHSA-77q5-rr5v-x43q: OpenClaw: Trusted retry endpoint checks could match hostname prefixesghsa · 2026-07-02
highGHSA-w5ww-7chg-mxcq: OpenClaw: Telegram interactive callbacks could skip commands.allowFromghsa · 2026-07-02