Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41366 Local Privilege Escalation in OpenClaw Before 2026.3.31 via Media Root Whitelisting https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41366
Post summary
The post announces CVE‑2026‑41366 as a local privilege escalation in OpenClaw before 2026.3.31 via media root whitelisting but gives no PoC, exploit code, active exploitation report, or patch information.
⚡ New CVE Alert: CVE-2026-41366 📊 Severity: 5.5 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41366 #CVE-2026-41366 #CVE #Medium #CyberSecurity #InfoSec https://t.co/PRaJoFT0ao
Post summary
The tweet announces CVE-2026-41366, noting a medium severity score and linking to the NVD entry, but it contains no additional technical details, exploit information, or patch guidance.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |