Log in Start free

Vulnerability · Published Mar 12, 2026 · Assigned by VulDB

CVE-2026-4040OpenClaw File Existence tools.exec.safeBins information exposure

Low 3.3

In plain English

A low-severity information exposure in OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 96.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmopenclaw2026.2.19GHSA-6c9j-x93c-rw6j

Affected products (as reported)

VendorProductVersions
n/a OpenClaw 2026.2.02026.2.12026.2.22026.2.32026.2.42026.2.52026.2.62026.2.7

Weakness: CWE-203, CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References