OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders
OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended access restrictions.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-34426US | high7.3 | — | ||
OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allo… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34510.jsonADVISORY
- https://github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5FIX
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87FIX
- https://github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901FIX
- https://github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gmADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-34510ADVISORY
- https://www.vulncheck.com/advisories/openclaw-remote-file-url-acceptance-in-windows-media-loadersADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan