CVE-2026-4040

low-risk
Published 2026-03-12

A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.

Do I need to act?

-
0.02% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Openclaw

References (7)

Product https://github.com/openclaw/openclaw/
Patch https://github.com/openclaw/openclaw/commit/bafdbb6f112409a65decd3d4e7350fbd637c...
Release Notes https://github.com/openclaw/openclaw/releases/tag/v2026.2.19-beta.1
Vendor Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-6c9j-x93c-rw6j
Permissions Required https://vuldb.com/?ctiid.350652
Third Party Advisory https://vuldb.com/?id.350652
Third Party Advisory https://vuldb.com/?submit.769581
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal