CVE-2026-41408

תיאור (מקור, אנגלית)

OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations. Attackers can exhaust disk space by downloading media files without triggering intended safety restrictions, causing availability impact.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 4.0

2.3 (LOW) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-30/7/2026

CWE

CWE-770

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-4g5x-2jfc-xm98 Vendor Advisory
• https://github.com/openclaw/openclaw/commit/2194587d70d2aef863508b945319c5a7c8‮… Patch
• https://www.vulncheck.com/advisories/openclaw-disk-exhaustion-via-media-downlo‮… Third Party Advisory