Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41389 OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers… https://www.cve.org/CVERecord?id=CVE-2026-41389
Post summary
The tweet announces CVE‑2026‑41389, describing a local‑root containment failure in OpenClaw that permits arbitrary local and UNC file access, but does not report exploitation or patch information.
CVE-2026-41389 Arbitrary File Access via Uncontained Tool-Result Media Paths in OpenClaw 2026.4.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41389
Post summary
CVE‑2026‑41389 is a newly disclosed vulnerability in OpenClaw 2026.4.7 that permits arbitrary file access via uncontained tool‑result media paths.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |