Is there a patch available for CVE-2026-41366?

Yes, a patch is available for CVE-2026-41366. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41366

Q: What is the CVSS score of CVE-2026-41366?

CVE-2026-41366 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-04-28 disclosure@vulncheck.com

Information Disclosure Openclaw

6.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 00:32 vuln.today

Analysis Generated

Apr 28, 2026 - 00:22 vuln.today

CVE Published

Apr 28, 2026 - 00:16 nvd

MEDIUM 6.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.

AnalysisAI

OpenClaw before version 2026.3.31 allows authenticated attackers to read arbitrary host files through improper validation in the appendLocalMediaParentRoots function, enabling exfiltration of credentials and sensitive data. The vulnerability permits model-initiated file access by exploiting a self-whitelisting mechanism that fails to properly validate media parent directory paths. Authentication is required, but the flaw affects confidentiality with a CVSS score of 6.0.

Technical ContextAI

OpenClaw's appendLocalMediaParentRoots function implements media library path management but fails to properly validate parent directory references before adding them to the whitelist. The root cause (CWE-732: Incorrect Permission Assignment for Critical Resource) indicates that the application grants excessive permissions or fails to enforce proper access controls on file system operations. Attackers can manipulate directory path validation to escape intended sandbox boundaries and access files outside the designated media directory. This is a local file disclosure vulnerability at the application layer, where the model or application layer can be induced to read arbitrary files through crafted path inputs.

RemediationAI

Upgrade to OpenClaw version 2026.3.31 or later, which includes fixes for the appendLocalMediaParentRoots validation logic. The upstream fix is available at https://github.com/openclaw/openclaw/commit/1ca4261d7e055d0be141ed79ebb1365d0fbc7364. As an interim compensating control, restrict the file system permissions of the OpenClaw process to exclude access to sensitive directories (e.g., /etc, /root, credential stores) using OS-level file access controls (SELinux, AppArmor, or Windows file ACLs). Additionally, disable or restrict the model inference feature if it is not required, and isolate OpenClaw in a container or sandbox with minimal file system permissions to limit the scope of readable files. These controls reduce exposure but do not eliminate the vulnerability; patching is the primary remediation.