Is there a patch available for CVE-2026-44996?

Yes, a patch is available for CVE-2026-44996. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-44996

Q: What is the CVSS score of CVE-2026-44996?

CVE-2026-44996 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29141 MEDIUM

Path Traversal (CWE-22)

2026-05-11 VulnCheck

GHSA-prp6-v677-xqhq

Path Traversal Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 18:22 NVD

LOW MEDIUM

CVSS changed

May 11, 2026 - 18:22 NVD

3.7 (LOW) 6.3 (MEDIUM)

Source Code Evidence Fetched

May 11, 2026 - 17:48 vuln.today

Analysis Generated

May 11, 2026 - 17:48 vuln.today

CVE Published

May 11, 2026 - 16:46 nvd

LOW 3.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on openclaw (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.15.

DescriptionCVE.org

OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks. Attackers can influence agent or tool-produced ReplyPayload.mediaUrl parameters to resolve absolute local paths or file URLs, read audio-like files, and embed them base64-encoded into webchat responses.

AnalysisAI

OpenClaw before version 2026.4.15 allows arbitrary local file read via the webchat audio embedding helper, which fails to enforce local media root containment checks. Attackers who can influence agent or tool-produced ReplyPayload.mediaUrl parameters can resolve absolute local paths or file:// URLs, read audio-like files, and embed them base64-encoded into webchat responses. The vulnerability is narrow in scope-files must be readable by the gateway process, have audio-like extensions, and fit within the webchat audio size cap-but crosses the security boundary between model/tool output and host filesystem access. No public exploit code or active exploitation has been identified, though the vulnerability is confirmed by vendor advisory.

Technical ContextAI

OpenClaw is a Node.js-based application framework that includes a webchat media handling system. The vulnerability exists in the chat-webchat-media server method, specifically in the buildWebchatAudioContentBlocksFromReplyPayloads function, which embeds audio files as base64-encoded content into webchat responses. The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal). The vulnerable code path accepts mediaUrl parameters from agent or tool output without validating that the resolved file path remains within configured localRoots directories. The fix involves threading localRoots configuration into the audio embedding helper and calling assertLocalMediaAllowed before reading local audio content, mirroring the containment checks applied elsewhere in the media-serving paths. The vulnerability affects npm package openclaw versions <= 2026.4.14.

RemediationAI

Upgrade OpenClaw to version 2026.4.15 or later; the latest stable release 2026.4.21 is recommended and includes additional safeguards via a trustedLocalMedia gate to prevent untrusted model/tool payloads from accessing local audio embedding. The upstream fix is confirmed in commit 6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde (https://github.com/openclaw/openclaw/commit/6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde). Before upgrading, avoid exposing webchat sessions to untrusted prompt content or third-party tools that can influence reply media URLs; isolate agent/tool execution to environments without sensitive local audio files or restrict the gateway process's filesystem access via OS-level controls (chroot, containerization, file permissions). Refer to the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-gfg9-5357-hv4c for detailed patch notes and deployment guidance.