CVE-2026-41908: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization
(updated )
The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy caller without operator.read could access assistant-media files and metadata that were otherwise inside allowed media roots.
The route still required successful gateway authentication and media-root checks. Severity is low.
References
- github.com/advisories/GHSA-v8qf-fr4g-28p2
- github.com/openclaw/openclaw/commit/99ef3a63c58440d53f8e45ad861b846032fcb036
- github.com/openclaw/openclaw/security/advisories/GHSA-v8qf-fr4g-28p2
- nvd.nist.gov/vuln/detail/CVE-2026-41908
- www.vulncheck.com/advisories/openclaw-scope-enforcement-bypass-in-assistant-media-route
Code Behaviors & Features
Detect and mitigate CVE-2026-41908 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →