CVE-2026-41366: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41366 is a local roots self-whitelisting vulnerability in OpenClaw's appendLocalMediaParentRoots function that allows model-initiated arbitrary host file read and credential exfiltration. It affects OpenClaw (npm) versions up to and including 2026.3.28, with the fix introduced in version 2026.3.31. The vulnerability was published on April 28, 2026, and was reported by researcher tdjackey. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, OpenClaw Advisory).

The root cause is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), with an estimated overlap with CWE-22 (Path Traversal). In vulnerable versions, the appendLocalMediaParentRoots function in src/media/local-roots.ts dynamically expanded the list of allowed local file system roots by appending parent directories of media sources provided at runtime — including those supplied via model-initiated requests. This meant that if a model passed a media source path such as /Users/peter/Pictures/photo.png, the function would add /Users/peter/Pictures to the allowed roots, effectively widening file access beyond the intended workspace scope. The fix (commit 1ca4261) removes this dynamic expansion entirely, making appendLocalMediaParentRoots a no-op that ignores mediaSources and returns only configuration-derived roots; the function is now marked @deprecated for plugin-SDK compatibility (OpenClaw Commit, OpenClaw Advisory).

Successful exploitation allows a low-privileged attacker to read arbitrary files from the host file system outside the intended media directory scope, including sensitive credentials and configuration files. The vulnerability has a high confidentiality impact with no integrity or availability impact. Because the file access is initiated through model requests, the attack can be difficult to distinguish from legitimate application behavior, increasing the risk of undetected credential exfiltration (GitHub Advisory, OpenClaw Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.021–0.029%, placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-level privileges and specific attack conditions (Attack Requirements: Present in CVSS v4.0), limiting its practical exploitability (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which contains the fix in commit 1ca4261d7e055d0be141ed79ebb1365d0fbc7364. No configuration-based workaround is documented; upgrading is the only recommended remediation. Additionally, administrators should review access logs for suspicious file read activity from low-privileged accounts, audit access to sensitive configuration files and credentials, and apply the principle of least privilege to application permissions (OpenClaw Advisory, OpenClaw Commit).

The OpenClaw maintainer (steipete) published the security advisory and noted that the impact is narrower than an initial critical framing, assessing it as medium severity because the self-whitelisting only occurs after configuration already permits tool-fs root expansion. The fix was credited to reporter tdjackey. No significant broader media coverage or notable external researcher commentary has been identified (OpenClaw Advisory).