CVE-2026-41339

Katalog CVE

CVSS 4.3 · Medium EPSS 0,37%

Kerentanan Exposure of Sensitive System Information to an Unauthorized Control Sphere pada openclaw. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling host fingerprinting and facilitating chained attacks.

Rincian

Terbit di NVD

23 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42 advisory vendor
• https://github.com/openclaw/openclaw/commit/676b748056b5efca6f1255708e9dd9469edf5e2e patch
• https://www.vulncheck.com/advisories/openclaw-information-disclosure-via-gateway-connect-snapshot advisory pihak ketiga