PT-2026-34709 · Openclaw · Openclaw

Zou Dikai · Published 2026-04-23 · Updated 2026-04-28 · CVE-2026-41908

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.20

Description A scope enforcement bypass exists in the 'assistant-media' route. This allows trusted-proxy callers who lack the operator.read scope to bypass identity-bearing HTTP auth path scope validation. Consequently, unauthorized users can access protected assistant-media files and metadata, enabling the retrieval of sensitive media content within allowed media roots.

Recommendations Update to version 2026.4.20.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41908

GHSA-QGX9-6PX9-7P75

GHSA-V8QF-FR4G-28P2

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/99ef3a63c58440d53f8e45ad861b846032fcb036 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-v8qf-fr4g-28p2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41908 · Security Note
• https://osv.dev/vulnerability/GHSA-qgx9-6px9-7p75 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8qf-fr4g-28p2 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/_cvereports/status/2049063705082532195 · Twitter Post
• https://vulncheck.com/advisories/openclaw-scope-enforcement-bypass-in-assistant-media-route · Note
• https://twitter.com/CVEnew/status/2047428096966697333 · Twitter Post