CVE-2026-34426: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
(updated )
Windows local-media handling accepted remote-host file URLs and UNC-style paths before local-path validation, so network-hosted file targets could be treated as local content.
References
- github.com/advisories/GHSA-h3x4-hc5v-v2gm
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5
- github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901
- github.com/openclaw/openclaw/commit/b57b680c0c34de907d57f60c38fb358e82aef8f7
- github.com/openclaw/openclaw/pull/59182
- github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm
- nvd.nist.gov/vuln/detail/CVE-2026-34426
- www.vulncheck.com/advisories/openclaw-approval-bypass-via-environment-variable-normalization
Code Behaviors & Features
Detect and mitigate CVE-2026-34426 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →