CVE-2026-4040 - OpenClaw File Existence tools.exec.safeBins information exposure

Back Back to CVE browser

MEDIUM

OpenClaw File Existence tools.exec.safeBins information exposure

Published Mar 12, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.20%

Description

A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.

Affected products

Vendor Openclaw Product OpenClaw Default
n/a
- Version
  2026.2.0
  Status
  affected
  Constraints
  -
- Version
  2026.2.1
  Status
  affected
  Constraints
  -
- Version
  2026.2.10
  Status
  affected
  Constraints
  -
- Version
  2026.2.11
  Status
  affected
  Constraints
  -
- Version
  2026.2.12
  Status
  affected
  Constraints
  -
- Version
  2026.2.13
  Status
  affected
  Constraints
  -
- Version
  2026.2.14
  Status
  affected
  Constraints
  -
- Version
  2026.2.15
  Status
  affected
  Constraints
  -
- Version
  2026.2.16
  Status
  affected
  Constraints
  -
- Version
  2026.2.17
  Status
  affected
  Constraints
  -
- Version
  2026.2.2
  Status
  affected
  Constraints
  -
- Version
  2026.2.3
  Status
  affected
  Constraints
  -
- Version
  2026.2.4
  Status
  affected
  Constraints
  -
- Version
  2026.2.5
  Status
  affected
  Constraints
  -
- Version
  2026.2.6
  Status
  affected
  Constraints
  -
- Version
  2026.2.7
  Status
  affected
  Constraints
  -
- Version
  2026.2.8
  Status
  affected
  Constraints
  -
- Version
  2026.2.9
  Status
  affected
  Constraints
  -
- Version
  2026.2.19-beta.1
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Openclaw

OpenClaw

n/a

Version	Status	Constraints
2026.2.0	affected	-
2026.2.1	affected	-
2026.2.10	affected	-
2026.2.11	affected	-
2026.2.12	affected	-
2026.2.13	affected	-
2026.2.14	affected	-
2026.2.15	affected	-
2026.2.16	affected	-
2026.2.17	affected	-
2026.2.2	affected	-
2026.2.3	affected	-
2026.2.4	affected	-
2026.2.5	affected	-
2026.2.6	affected	-
2026.2.7	affected	-
2026.2.8	affected	-
2026.2.9	affected	-
2026.2.19-beta.1	unaffected	-

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.2.19

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-203

References (10)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-11565
Advisory
https://github.com/advisories/GHSA-6c9j-x93c-rw6j
Advisory
https://github.com/openclaw/openclaw/
product
https://github.com/openclaw/openclaw/commit/bafdbb6f112409a65decd3d4e7350fbd637c7754
patch
https://github.com/openclaw/openclaw/releases/tag/v2026.2.19-beta.1
patchRelease Notes
https://github.com/openclaw/openclaw/security/advisories/GHSA-6c9j-x93c-rw6j
relatedVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4040
https://vuldb.com/?ctiid.350652
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.350652
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.769581
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-11565		Advisory
https://github.com/advisories/GHSA-6c9j-x93c-rw6j		Advisory
https://github.com/openclaw/openclaw/		product
https://github.com/openclaw/openclaw/commit/bafdbb6f112409a65decd3d4e7350fbd637c7754		patch
https://github.com/openclaw/openclaw/releases/tag/v2026.2.19-beta.1		patchRelease Notes
https://github.com/openclaw/openclaw/security/advisories/GHSA-6c9j-x93c-rw6j		relatedVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4040
https://vuldb.com/?ctiid.350652		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.350652		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.769581		third-party-advisoryThird Party AdvisoryVDB Entry