CVE-2026-41370: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41370 is a path traversal vulnerability in OpenClaw's ACP (Auto-reply Control Plane) dispatch component that allows low-privileged authenticated attackers to read arbitrary files by manipulating inbound channel attachment paths. It affects all OpenClaw (npm) versions up to and including 2026.3.28, with the fix introduced in version 2026.3.31. The vulnerability was disclosed on April 28, 2026, with the underlying fix committed on March 30, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the ACP dispatch handler in src/auto-reply/reply/dispatch-acp.ts read attachment file paths supplied via inbound channel messages without adequately enforcing that those paths resided within permitted attachment-cache or root directories. Prior to the fix, the code called normalizeAttachmentPath() and directly read files via fs.readFile() without resolving symlinks or validating the canonical path against allowed roots. An attacker with low-level access could supply crafted attachment paths — including relative paths with ../ sequences, file:// URIs, or symlink targets — to cause the server to read files outside the intended directories. The fix (commit 566fb73) introduced MediaAttachmentCache with localPathRoots enforcement, fs.realpath() canonicalization, and O_NOFOLLOW flags on POSIX to prevent symlink-based escapes (GitHub Commit, GitHub Security Advisory).

Successful exploitation allows a low-privileged authenticated attacker to read arbitrary files from the server's filesystem over the network, with no user interaction required. The impact is limited to confidentiality — there is no integrity or availability impact — but sensitive files such as configuration files, credentials, private keys, or application secrets could be exposed. There is no evidence of lateral movement capability directly from this vulnerability, though exfiltrated credentials could enable further access (Github Advisory, GitHub Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.051% (0.000510), placing it in a low exploitation probability tier. Exploitation requires a low-privilege authenticated account, which slightly raises the bar compared to unauthenticated vulnerabilities, but the attack complexity is low and no special conditions are needed.

1. Obtain low-privileged access: Authenticate to the OpenClaw instance with any valid low-privileged account, as the vulnerability requires only PR:L (low privileges required).
2. Craft a malicious attachment path: Prepare an inbound channel message (e.g., via iMessage ACP channel) with a manipulated MediaPath field containing a path traversal sequence such as ../../../../etc/passwd, a file:///etc/passwd URI, or a relative path resolving outside the allowed attachment root.
3. Send the crafted message to ACP dispatch: Submit the message through the inbound channel so that the ACP dispatch handler (tryDispatchAcpReply) processes the attachment. In vulnerable versions (≤2026.3.28), the handler calls normalizeAttachmentPath() and reads the file directly without root enforcement.
4. Retrieve the file contents: The file contents are base64-encoded and included in the ACP turn attachment data, which the attacker can then decode to read the targeted file (e.g., /etc/passwd, application config files, or private keys) (GitHub Security Advisory, GitHub Commit).

• Logs: Application logs showing ACP dispatch processing attachment paths containing ../, file://, or absolute paths outside expected attachment directories; verbose log entries referencing unexpected file paths in dispatch-acp or media-understanding modules.
• File System: Unexpected access timestamps on sensitive files (e.g., /etc/passwd, configuration files, .env files, private key files) coinciding with ACP dispatch activity.
• Network: Inbound channel messages with MediaPath values containing path traversal sequences (../), file:// URIs pointing to system files, or absolute paths outside the configured attachment root directories.
• Process: Node.js process (openclaw) opening file handles to files outside the expected attachment cache or root directories, observable via lsof or auditd file access logs.

Upgrade OpenClaw (npm package) to version 2026.3.31 or later, which enforces attachment root path validation via MediaAttachmentCache, canonical path resolution with fs.realpath(), and O_NOFOLLOW flags to block symlink traversal. The fix is available in commit 566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d. As a temporary workaround, restrict network access to the OpenClaw ACP dispatch functionality to authorized and trusted users only, and monitor logs for suspicious attachment path patterns. No configuration-only workaround fully mitigates the vulnerability without upgrading (GitHub Security Advisory, GitHub Commit).

The vulnerability was reported by researcher north-echo and acknowledged by the OpenClaw maintainers, who published security advisory GHSA-58q2-7r52-jq62. The advisory was also catalogued by VulnCheck. No significant broader media coverage or notable community commentary beyond the GitHub advisory and standard vulnerability database entries has been observed.