PT-2026-35803 · Openclaw · Openclaw

Yuki Shiroi · CVE-2026-42424 · Published 2026-04-09 · Updated 2026-04-29

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description OpenClaw treats shared reply MEDIA paths as trusted, which allows crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references, causing another channel to read local file paths as trusted generated media.

Recommendations Update to version 2026.4.8.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-73

Related Identifiers

CVE-2026-42424

GHSA-QQQ7-4HXC-X63C

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42424.json · Exploit
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qqq7-4hxc-x63c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42424 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qqq7-4hxc-x63c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42424 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2049278421000204334 · Twitter Post
• https://twitter.com/CVEnew/status/2049227499284939058 · Twitter Post
• https://vulncheck.com/advisories/openclaw-local-file-exfiltration-via-shared-reply-media-paths · Note