OpenClaw CVE-2026-41370

Exploitation requires the attacker to possess valid low-privilege authenticated credentials to the OpenClaw system (PR:L from CVSS vector). The vulnerability exists specifically in the ACP dispatch component when processing inbound channel attachment paths, so the target deployment must have this channel attachment functionality enabled and accessible to authenticated users. No special user interaction is required (UI:N), and attack complexity is low (AC:L), meaning default configurations of OpenClaw versions before 2026.3.31 are vulnerable once authentication is achieved. Exploitation is limited by the authentication barrier - unauthenticated remote attackers cannot exploit this issue - and by the read-only nature of the vulnerability (attackers can only read files accessible to the OpenClaw process user account, not modify or execute arbitrary code).

Real-world risk is moderate despite the 7.1 CVSS score. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-exploitable with low complexity, but the PR:L requirement means attackers need valid low-privilege credentials, significantly reducing the attack surface compared to unauthenticated vulnerabilities. The high confidentiality impact (VC:H) with no integrity or availability impact suggests attackers can read sensitive files but cannot modify systems or cause denial of service. Absence from CISA KEV and lack of public exploit code (based on available references pointing only to patch commit and advisory) suggest this is not yet widely exploited. EPSS data not provided in input, limiting probabilistic risk assessment. The attack is automatable once credentials are obtained (AT:N, UI:N), making it a concern for environments with weak authentication or credential exposure. Priority should be HIGH for systems processing sensitive data with authenticated external users, MEDIUM for internal-only deployments with strong access controls. This is a genuine data exfiltration risk rather than a theoretical vulnerability, warranting prompt patching.

An authenticated attacker with low-privilege credentials connects to an OpenClaw server and crafts a malicious ACP dispatch request with an inbound channel attachment path containing traversal sequences like '../../../../etc/passwd' or similar patterns to escape the intended attachment directory. The vulnerable dispatch handler fails to properly canonicalize and validate the path, allowing the attacker to bypass both attachment-cache and root directory security checks, ultimately reading arbitrary system files such as configuration files containing credentials, private keys, or application secrets.