Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-41908
4.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): NONE
- Availability impact (A): NONE
Activity log
- Created suggestion
OpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route
OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access protected assistant-media files and metadata. Attackers can bypass identity-bearing HTTP auth path scope validation to retrieve sensitive media content within allowed media roots.
References
-
GitHub Security Advisory (GHSA-v8qf-fr4g-28p2) vendor-advisory
-
Patch Commit patch
-
https://www.vulncheck.com/advisories/openclaw-scope-enforcement-bypass-in-assis… third-party-advisory
Affected products
OpenClaw
- ==2026.4.20
- <2026.4.20
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@chrisportela Chris Portela <chris@chrisportela.com>