CVE-2026-41366CWE-732

OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting

Medium · published April 27, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00318 · 23.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-04-27T23:24Z
EPSS history
Timeline
  • 27 APR 23:24Z
    OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting
    cvelistv5