CVE-2026-44105

MediumCVSS 6.6/10Last modified Jul 30, 2026

Description

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Jul 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-441067.8A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary comman CVE-2026-441077.5A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enab CVE-2026-441089.8Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates CVE-2026-441099.8OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthent CVE-2026-441108.8OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing CVE-2026-441114.3OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read a CVE-2026-441129.6OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers t CVE-2026-441137.7OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to re CVE-2026-441147.8OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing CVE-2026-441158.8OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Atta CVE-2026-441168.6OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validat CVE-2026-441175.8OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attac