What is the CVSS score of CVE-2026-29611?

CVE-2026-29611 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-29611?

Openclaw versions through 2026.2.14 contain a critical file disclosure vulnerability that could allow unauthorized access to sensitive data stored on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-29611?

Within 24 hours: Identify all systems running Openclaw versions up to 2026.2.14 and assess data sensitivity. Within 7 days: Apply the available vendor patch to all affected instances in a staged rollout, prioritizing production environments. Within 30 days: Complete patching of all remaining systems, conduct file access logs review for signs of exploitation, and validate patch deployment.

Openclaw CVE-2026-29611

HIGH

External Control of File Name or Path (CWE-73)

2026-03-05 disclosure@vulncheck.com

GHSA-rwj8-p9vq-25gv

LFI Openclaw

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 11, 2026 - 00:58 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that allows attackers to read arbitrary files from the local filesystem. The sendBlueBubblesMedia function fails to validate mediaPath parameters against an allowlist, enabling attackers to request sensitive files like /etc/passwd and exfiltrate them as media attachments.

AnalysisAI

Openclaw versions up to 2026.2.14 contains a vulnerability that allows attackers to read arbitrary files from the local filesystem (CVSS 7.5).

Technical ContextAI

affects Openclaw. OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that allows attackers to read arbitrary files from the local filesystem. The sendBlueBubblesMedia function fails to validate mediaPath parameters against an allowlist, enabling attackers to request sensitive files like /etc/passwd and exfiltrate them as media attachments.