CVE-2026-41339
CVE-2026-41339 · OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling host fingerprinting and facilitating chained attacks.
CVSS 5.3 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
Fuentes originales
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42
- https://github.com/openclaw/openclaw/commit/676b748056b5efca6f1255708e9dd9469edf5e2e
- https://www.vulncheck.com/advisories/openclaw-information-disclosure-via-gateway-connect-snapshot
- https://nvd.nist.gov/vuln/detail/CVE-2026-41339