CVE-2026-4040

Katalog CVE

CVSS 5.5 · Medium EPSS 0,20%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada openclaw. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.

Rincian

Terbit di NVD

12 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6c9j-x93c-rw6j advisory vendor
• https://github.com/openclaw/openclaw/commit/bafdbb6f112409a65decd3d4e7350fbd637c7754 patch
• https://vuldb.com/?id.350652 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.769581 advisory pihak ketiga · vdb entry
• https://github.com/openclaw/openclaw/ product
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.19-beta.1 release notes
• https://vuldb.com/?ctiid.350652 permissions required · vdb entry