요약
- CVE-2026-41366은(는) openclaw (openclaw), openclaw에 영향을 주는 보통 (CVSS 5.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.18%, 전체 취약점의 7.7%보다 높음.
- 조치: 2026.3.31 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration
Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
1ca4261d7e055d0be141ed79ebb1365d0fbc7364 — 2026-03-30T17:15:03+01:00
OpenClaw thanks @tdjackey for reporting.
NVD description
OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free