PT-2026-29545 · Openclaw · Openclaw

Fushuling + 1 · CVE-2026-34510 · Published 2026-03-26 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description Windows media loaders fail to perform local-path validation before accepting remote-host file URLs and UNC-style paths (Universal Naming Convention, a standard for specifying the location of shared resources on a network). This allows attackers to provide network-hosted file targets that the system treats as local content, bypassing intended access restrictions.

Recommendations Update to version 2026.3.22.

Exploit

Fix

Weakness Enumeration

CWE-178

CWE-41

CWE-40

Related Identifiers

CVE-2026-34510

GHSA-98CH-45WP-CH47

GHSA-H3X4-HC5V-V2GM

Affected Products

Openclaw

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34510.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901 · Patch
• https://github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5 · Patch
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34426 · Security Note
• https://osv.dev/vulnerability/GHSA-98ch-45wp-ch47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34510 · Security Note
• https://osv.dev/vulnerability/GHSA-h3x4-hc5v-v2gm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34510 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/b57b680c0c34de907d57f60c38fb358e82aef8f7 · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-98ch-45wp-ch47 · Note
• https://github.com/openclaw/openclaw/pull/59182 · Note
• https://github.com/openclaw/openclaw/commit/7eb094a00d80e9f6bf0e62f2c45d3b88ff67c04d · Note