CVE-2026-4040

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-404008.0Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.CVE-2026-404017.1Windows TCP/IP Denial of Service Vulnerability CVE-2026-404029.3Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.CVE-2026-404038.8Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.CVE-2026-404047.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability CVE-2026-404057.5Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.CVE-2026-404067.5Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.CVE-2026-404077.8Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2026-404087.8Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-404097.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability CVE-2026-40418.8A security flaw has been discovered in Tenda i12 1.0.0.6(2204). Impacted is the function vos_strcpy of the file /goform/exeCommand. The mani CVE-2026-404107.0Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.