Is there a patch available for CVE-2026-41383?

Yes, a patch is available for CVE-2026-41383. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41383

Q: What is the CVSS score of CVE-2026-41383?

CVE-2026-41383 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26092 MEDIUM

Path Traversal (CWE-22)

2026-04-28 VulnCheck

Path Traversal Openclaw

6.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 20:07 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

Apr 28, 2026 - 19:52 NVD

8.1 (HIGH) 6.1 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26092

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.2.

DescriptionCVE.org

OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data.

AnalysisAI

OpenClaw before version 2026.4.2 allows authenticated attackers to delete arbitrary remote directories during mirror mode synchronization operations by manipulating remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. An attacker with login credentials can craft malicious OpenShell config paths that cause the mirror sync function to delete unintended remote directory contents before replacing them with uploaded workspace data, resulting in data loss and potential service disruption.

Technical ContextAI

OpenClaw's mirror mode implements synchronization between local and remote workspaces using configuration paths specified in OpenShell config files. The vulnerability stems from insufficient input validation on the remoteWorkspaceDir and remoteAgentWorkspaceDir configuration parameters, which are used to construct file system paths for directory deletion operations during sync. This represents a classic path traversal vulnerability (CWE-22) where attacker-controlled path components are not properly validated before being passed to directory deletion routines. The CVE affects all versions of OpenClaw prior to 2026.4.2, as identified in the affected product CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*.

RemediationAI

Immediately upgrade OpenClaw to version 2026.4.2 or later, which contains the vendor-released patch. The fix addresses the path traversal vulnerability by implementing proper validation of remoteWorkspaceDir and remoteAgentWorkspaceDir configuration parameters. Until patching is possible, restrict authentication credentials to trusted administrators only and audit all users with access to OpenClaw mirror mode functionality. Additionally, disable mirror mode synchronization operations if they are not essential to operations, and implement file system monitoring on remote workspace directories to detect and alert on unexpected deletion events. Backup remote workspace directories regularly and maintain offline copies to recover from potential data loss caused by exploitation. The patch is available at the commit reference https://github.com/openclaw/openclaw/commit/b21c9840c2e38f4bb338d031511b479d5f07ca25 and in the official vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-m34q-h93w-vg5x.