CVE-2026-42424: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-42424 is a local file exfiltration vulnerability in OpenClaw, a user-controlled local AI assistant, caused by improper trust handling of shared reply MEDIA: paths. Versions up to and including 2026.4.4 (npm package) are affected; the issue was fixed in version 2026.4.8. The vulnerability was published on April 28, 2026, with the security advisory originally authored by steipete and credited to reporter @threalwinky (GitHub Advisory). It carries a CVSS v3.1 base score of 5.0 (Medium) and a CVSS v4.0 base score of 5.9 (Medium) (Feedly).

The root cause is classified as CWE-73 (External Control of File Name or Path) and CWE-668 (Exposure of Resource to Wrong Sphere): OpenClaw fails to validate or restrict MEDIA: URI paths embedded in shared replies, treating them as trusted, internally-generated media references (GitHub Advisory). An attacker with low privileges can craft a malicious shared reply containing a MEDIA: path pointing to an arbitrary local file; when another channel processes this reply, it reads the referenced local file path as if it were legitimate generated media, causing cross-channel file exfiltration (Feedly). Exploitation requires local access, low privileges, and user interaction (passive). The fix, applied in commit d7c3210, addresses DNS pinning and fetch-guard hardening in the network layer (GitHub Commit).

Successful exploitation allows a low-privileged attacker to exfiltrate arbitrary local files accessible to the OpenClaw process by causing a separate channel to read and expose those files as trusted media content. The impact is limited to confidentiality (high), with no integrity or availability impact. Because OpenClaw is scoped as a user-controlled local assistant rather than a multi-tenant service, the advisory notes this vulnerability is evaluated within OpenClaw's own trust model (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication (Feedly). The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and passive user interaction, which further limits the practical attack surface.

1. Gain low-privileged access: Obtain a low-privileged account or local access to a system running a vulnerable version of OpenClaw (≤2026.4.4 npm).
2. Craft a malicious shared reply: Construct a shared reply message that contains a MEDIA: URI referencing a sensitive local file path (e.g., MEDIA:/etc/passwd or MEDIA:C:\Users\victim\secrets.txt) instead of a legitimate generated media reference.
3. Deliver the crafted reply to a target channel: Share or inject the malicious reply into a channel that another user or process is actively monitoring or will interact with.
4. Trigger processing by the target channel: Wait for or induce the target channel to process the shared reply; OpenClaw treats the MEDIA: path as trusted and reads the referenced local file.
5. Collect exfiltrated file content: The file contents are exposed as if they were legitimately generated media, allowing the attacker to retrieve sensitive local data (GitHub Advisory, Feedly).

• File System: Unexpected access to sensitive local files (e.g., /etc/passwd, SSH keys, configuration files) by the OpenClaw process, visible in OS-level file access audit logs.
• Logs: OpenClaw application logs showing MEDIA: URI references pointing to local filesystem paths rather than expected generated media locations; cross-channel media resolution events for paths outside the expected media directory.
• Process: The OpenClaw Node.js process reading files outside its normal working or media output directory, detectable via process monitoring tools (e.g., auditd, inotifywait on Linux, or Sysmon on Windows).
• Network: If exfiltrated content is subsequently transmitted, unusual outbound data transfers from the host running OpenClaw to external endpoints (GitHub Advisory).

Upgrade OpenClaw (npm package) to version 2026.4.8 or later, which contains the verified fix at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 (GitHub Advisory, GitHub Commit). As interim mitigations, restrict access to OpenClaw systems to trusted users only, implement access controls limiting who can create shared replies, and monitor file access logs for suspicious read patterns. Network segmentation to limit inter-channel communication can also reduce exposure (Feedly).

The vulnerability was reported by security researcher @threalwinky and the advisory was published by steipete on April 8, 2026, with the CVE assigned shortly after (GitHub Advisory). Coverage appeared across CVE aggregation platforms and a brief write-up was published at infinitsec.net shortly after disclosure. No significant broader media coverage or notable threat actor commentary has been observed.