CVE-2026-4040: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-4040 is an information disclosure vulnerability in OpenClaw (npm package), a personal AI assistant platform, affecting versions 2026.2.0 through 2026.2.17. The flaw resides in the tools.exec.safeBins File Existence Handler (tools.exec.safeBins approval flow), where differing allow/deny behavior based on whether a candidate file path exists on the host filesystem creates a file-existence oracle. It was published on March 12, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-203 (Observable Discrepancy) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When tools.exec.safeBins validated candidate binary paths, it performed host filesystem existence checks as part of its allow/deny decision logic; an attacker could observe the behavioral difference in command outcomes (allowed vs. denied) to infer whether specific file paths exist on the host. The attack vector is local and requires low privileges — an attacker must have access to the execution surface (e.g., the ability to invoke the exec tool) but no additional user interaction. Specific file-oriented flags such as sort -o, jq -f, and grep -f were exploitable vectors for triggering the discrepancy (GitHub Advisory, Patch Commit).

Successful exploitation allows a local attacker with access to the tools.exec surface to enumerate the host filesystem by probing for the presence or absence of specific files — including sensitive configuration files, secrets, or credential stores. While there is no direct integrity or availability impact (CVSS confidentiality impact: High, integrity/availability: None), the information gained can significantly improve follow-on attack planning, such as identifying credential files or configuration paths for subsequent exploitation (GitHub Advisory, Feedly).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-4040. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the tools.exec execution surface, limiting the attacker pool to users or agents with existing system access (Feedly, GitHub Advisory).

1. Gain access to the execution surface: Obtain local access to a system running a vulnerable OpenClaw instance (versions 2026.2.0–2026.2.17) with the tools.exec.safeBins feature enabled and access to the exec tool.
2. Identify safe-bin candidates: Determine which binaries are configured in safeBins (e.g., sort, jq, grep) by reviewing OpenClaw configuration or through trial and error.
3. Craft file-probing commands: Invoke the exec tool with file-oriented flags for a safe-bin binary targeting a known-existing file path (e.g., sort -o /etc/passwd) and observe the allow/deny outcome.
4. Compare outcomes: Repeat the same command targeting a non-existent file path (e.g., sort -o /etc/nonexistent_secret). A behavioral difference in the allow/deny response reveals whether the target file exists on the host filesystem.
5. Enumerate sensitive paths: Systematically probe for sensitive file paths (e.g., secrets, API keys, config files) by iterating over candidate paths and recording the discrepant outcomes to build a map of existing files for follow-on attacks (GitHub Advisory, Patch Commit).

• Logs: Repeated invocations of the OpenClaw exec tool with file-oriented flags (sort -o, jq -f, grep -f) targeting diverse or sensitive file paths in rapid succession; patterns of alternating allow/deny outcomes for similar commands differing only in target filename.
• Process: Unusual exec tool calls from agent sessions probing system paths such as /etc/, ~/.openclaw/, or other configuration/secret directories with safe-bin binaries.
• File System: No direct file system artifacts are created by this oracle attack; however, audit logs of tools.exec invocations (if enabled) may show systematic enumeration patterns across many file paths.

Upgrade OpenClaw (npm package openclaw) to version 2026.2.18 or later (patched version), or to the beta release 2026.2.19-beta.1 which includes the fix. The patch (commit bafdbb6f112409a65decd3d4e7350fbd637c7754) changes safeBins validation to use deterministic argv-only logic with no host filesystem existence checks, and blocks file-oriented flags (sort -o, sort --output, jq -f/--from-file, grep -f/--file) for safe-bin mode. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation (GitHub Advisory, Release Notes).

The vulnerability was reported by security researcher @nedlir and credited in both the GitHub Security Advisory and the OpenClaw release notes. The advisory was published by orlyjamie on February 19, 2026, and the fix was developed by the OpenClaw maintainer steipete. No significant broader media coverage or notable community debate has been identified beyond the official advisory and changelog (GitHub Advisory, Release Notes).