PT-2026-35791 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-07 · Updated 2026-04-30 · CVE-2026-41408

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A resource exhaustion issue exists in media downloads that bypasses core safety limits regarding file size, count, and cleanup operations. This allows attackers to exhaust disk space by downloading media files without triggering safety restrictions, resulting in an availability impact.

Recommendations Update to version 2026.3.31.

Fix

Unrestricted File Upload

Allocation of Resources Without Limits

Weakness Enumeration

CWE-434

CWE-770

Related Identifiers

CVE-2026-41408

GHSA-4G5X-2JFC-XM98

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/2194587d70d2aef863508b945319c5a7c88b12ce · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4g5x-2jfc-xm98 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4g5x-2jfc-xm98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41408 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-disk-exhaustion-via-media-download-bypass · Note
• https://twitter.com/CVEnew/status/2049227512505385195 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049314258140242387 · Twitter Post
• https://t.me/cveNotify/161625 · Telegram Post