CVE-2026-41389

Webchat tool-result media normalization could pass local and UNC-style file paths into the host-side media embedding path without applying the configured local-root containment policy.

Affected versions

• Affected: >= 2026.4.7, < 2026.4.15
• Patched: 2026.4.15

A crafted tool-result media reference could cause the host to attempt local file reads or Windows UNC/network path access while preparing webchat media blocks. This could disclose allowed host files or trigger network credential exposure on affected Windows deployments. Severity remains medium because exploitation depends on a tool-result media path reaching the webchat embedding path, but the sink is a host-side file read before the user sees the rendered result.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2026-41389 has a CVSS score of 5.8 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2026.4.15); upgrading removes the vulnerable code path.

Kodem intelligence

OpenClaw 2026.4.15 hardens the webchat media path and the shared media resolver. Remote-host file:// URLs and Windows network paths are rejected before filesystem access, and audio embedding now enforces configured localRoots containment before stat or read operations.

Verified in v2026.4.15:

• src/gateway/server-methods/chat-webchat-media.ts uses safe file-URL parsing, rejects Windows network paths, and calls assertLocalMediaAllowed before probing local audio files.
• src/media/web-media.ts rejects remote-host file:// URLs, Windows network paths, and local-root bypasses on the shared media path.
• src/gateway/server-methods/chat-webchat-media.test.ts covers both remote-host file:// rejection and local-root denial before filesystem access.

Fix commits included in v2026.4.15 and absent from v2026.4.14:

• 1470de5d3e0970856d86cd99336bb8ada3fe87da via PR #67293
• 6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde via PR #67298
• 52ef42302ead9e183e6c8810e0a04ee4ef8ae9fc via PR #67303 as defense-in-depth for trusted media passthrough anchoring

Thanks to @Kherrisan for reporting this issue.

1. What is CVE-2026-41389? CVE-2026-41389 is a medium-severity path traversal vulnerability in openclaw (npm), affecting versions >= 2026.4.7, < 2026.4.15. It is fixed in 2026.4.15. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2026-41389? CVE-2026-41389 has a CVSS score of 5.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of openclaw are affected by CVE-2026-41389? openclaw (npm) versions >= 2026.4.7, < 2026.4.15 is affected.
4. Is there a fix for CVE-2026-41389? Yes. CVE-2026-41389 is fixed in 2026.4.15. Upgrade to this version or later.
5. Is CVE-2026-41389 exploitable, and should I be worried? Whether CVE-2026-41389 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-41389 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-41389? Upgrade openclaw to 2026.4.15 or later.