Information disclosure in Openclaw
CVE-2026-4040
A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.
Vulnerability class: Information Disclosure
EPSS: 0.001 (3.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Openclaw
- N/a Openclaw — versions 2026.2.0, 2026.2.1, 2026.2.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (related, Vendor Advisory)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (Release Notes, patch)
- cna@vuldb.com (Product, product)
Frequently asked questions
- What is CVE-2026-4040?
- CVE-2026-4040 is a low-severity vulnerability in Openclaw, classified under Information Disclosure. CVSS score: 3.3/10. Published 2026-03-12.
- How severe is CVE-2026-4040?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2026-4040 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.