En bref
- CVE-2026-41366 est une vulnérabilité MOYENNE (CVSS 5.5) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.18%, plus élevée que 7.7% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.31 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration
Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
1ca4261d7e055d0be141ed79ebb1365d0fbc7364 — 2026-03-30T17:15:03+01:00
OpenClaw thanks @tdjackey for reporting.
NVD description
OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free