CVE-2026-41339 - OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot

Back Back to CVE browser

MEDIUM

OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot

Published Apr 23, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.37%

Description

OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling host fingerprinting and facilitating chained attacks.

Affected products

Vendor OpenClaw Product OpenClaw Default
unaffected
Affected
- ≥ 0, < 2026.4.2
Unaffected
- 2026.4.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
OpenClaw	OpenClaw	unaffected	Affected ≥ 0, < 2026.4.2 Unaffected 2026.4.2

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.4.2

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-497

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25323
Advisory
https://github.com/advisories/GHSA-2f7j-rp58-mr42
Advisory
https://github.com/openclaw/openclaw/commit/676b748056b5efca6f1255708e9dd9469edf5e2e
patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41339
https://www.vulncheck.com/advisories/openclaw-information-disclosure-via-gateway-connect-snapshot
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25323		Advisory
https://github.com/advisories/GHSA-2f7j-rp58-mr42		Advisory
https://github.com/openclaw/openclaw/commit/676b748056b5efca6f1255708e9dd9469edf5e2e		patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41339
https://www.vulncheck.com/advisories/openclaw-information-disclosure-via-gateway-connect-snapshot		third-party-advisoryThird Party Advisory