CVE-2026-41366: Openclaw Information Disclosure Vulnerability

CVE-2026-41366 Overview

OpenClaw before version 2026.3.31 contains a local roots self-whitelisting vulnerability in the appendLocalMediaParentRoots function that enables model-initiated arbitrary host file read. This vulnerability stems from improper validation of media parent directories, allowing attackers to bypass security controls and access sensitive files on the host system. Successful exploitation can lead to credential exfiltration and unauthorized access to confidential data.

Critical Impact

Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files through arbitrary host file read capabilities.

Affected Products

• OpenClaw versions prior to 2026.3.31
• OpenClaw for Node.js environments

Discovery Timeline

• 2026-04-28 - CVE-2026-41366 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41366

Vulnerability Analysis

This vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The flaw exists within the appendLocalMediaParentRoots function, which fails to properly validate and restrict media parent directory configurations. This improper permission handling allows the function to self-whitelist local roots, enabling unauthorized file system access.

The vulnerability is network-exploitable, requiring low privileges and no user interaction, though certain preconditions must be met for successful exploitation. The primary impact is on confidentiality, as attackers can read arbitrary files from the host system without modifying or disrupting system availability.

Root Cause

The root cause lies in incorrect permission assignment within the appendLocalMediaParentRoots function. The function does not adequately validate paths being added to the local media parent roots whitelist, allowing attackers to inject arbitrary directory paths. This self-whitelisting behavior bypasses intended access controls, granting read access to files outside the intended scope.

Attack Vector

The attack leverages the network-accessible nature of the OpenClaw application. An authenticated attacker with low-level privileges can manipulate the media parent directory configuration to include sensitive system directories. Once whitelisted, the attacker can initiate file read operations to exfiltrate credentials, configuration files, and other sensitive data from the host system.

The exploitation flow involves:

1. Authenticating to the OpenClaw application with minimal privileges
2. Manipulating the appendLocalMediaParentRoots function to whitelist arbitrary directories
3. Initiating model-based file read operations targeting sensitive files
4. Exfiltrating credentials and confidential data from the accessible paths

Detection Methods for CVE-2026-41366

Indicators of Compromise

• Unexpected modifications to media parent root configurations in OpenClaw
• Unusual file read operations targeting system directories like /etc/, /root/, or credential storage locations
• Anomalous authentication patterns followed by configuration changes
• Log entries showing appendLocalMediaParentRoots being called with suspicious directory paths

Detection Strategies

• Monitor OpenClaw configuration changes for unexpected media parent root additions
• Implement file integrity monitoring on sensitive system directories and credential files
• Audit authentication logs for low-privileged users making configuration modifications
• Deploy application-level logging to track calls to the appendLocalMediaParentRoots function

Monitoring Recommendations

• Enable verbose logging for the OpenClaw application to capture all configuration changes
• Set up alerts for file access attempts on sensitive directories from the OpenClaw process
• Monitor network traffic for unusual data exfiltration patterns from systems running OpenClaw
• Review access logs regularly for signs of credential harvesting or sensitive file access

How to Mitigate CVE-2026-41366

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.31 or later immediately
• Review existing media parent root configurations for unauthorized entries
• Audit file system access logs for signs of exploitation
• Restrict network access to OpenClaw instances to trusted sources only

Patch Information

OpenClaw has released a security patch addressing this vulnerability. The fix is available in version 2026.3.31 and later. The specific commit addressing this issue can be found in the GitHub Commit Update. Additional details are available in the GitHub Security Advisory GHSA-57gh-m6rq-54cf.

Workarounds

• Implement strict file system permissions to prevent the OpenClaw process from accessing sensitive directories
• Deploy network segmentation to isolate OpenClaw instances from sensitive systems
• Use application firewalls to restrict incoming requests to known trusted sources
• Regularly audit and remove unused or unauthorized media parent root entries

# Configuration example
# Restrict OpenClaw process file system access using AppArmor or SELinux
# Example SELinux boolean to limit file access
setsebool -P openclaw_read_user_content off

# Verify OpenClaw version to ensure patched release
npm list openclaw | grep openclaw
# Expected output should show version 2026.3.31 or later