CVE-2026-4040

OpenClaw File Existence tools.exec.safeBins information exposure

State: Published
Severity: 4.8 Medium
Published: Mar 12, 2026
Updated: Mar 12, 2026
Reserved: Mar 12, 2026

Description

A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-203 Information Exposure Through Discrepancy
CWE-200 Information Disclosure

Affected Products

Product	Versions
OpenClawn/a	2026.2.0Affected 2026.2.1Affected 2026.2.2Affected 2026.2.3Affected 2026.2.4Affected 2026.2.5Affected 2026.2.6Affected 2026.2.7Affected 2026.2.8Affected 2026.2.9Affected 2026.2.10Affected 2026.2.11Affected 2026.2.12Affected 2026.2.13Affected 2026.2.14Affected 2026.2.15Affected 2026.2.16Affected 2026.2.17Affected 2026.2.19-beta.1Not affected

References

VDB-350652 | OpenClaw File Existence tools.exec.safeBins information exposurevdb-entrytechnical-description
VDB-350652 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #769581 | openclaw 2026.2.17 Information Disclosurethird-party-advisory
https://github.com/openclaw/openclaw/security/advisories/GHSA-6c9j-x93c-rw6jrelated
https://github.com/openclaw/openclaw/commit/bafdbb6f112409a65decd3d4e7350fbd637c7754patch
https://github.com/openclaw/openclaw/releases/tag/v2026.2.19-beta.1patch
https://github.com/openclaw/openclaw/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.