CVE-2026-41408
Resource Exhaustion in OpenClaw Media Downloads Causes Disk Exhaustion
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.31 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can impact you by causing disk space exhaustion on the affected system, leading to availability issues.
Specifically, attackers can download large or numerous media files that bypass safety limits, filling up disk storage and potentially causing denial of service conditions.
The impact is limited to availability and does not allow further exploitation such as data theft or integrity compromise.
Can you explain this vulnerability to me?
CVE-2026-41408 is a resource exhaustion vulnerability in OpenClaw versions before 2026.3.31. It allows attackers to bypass core safety limits that restrict file size, file count, and cleanup operations during media downloads.
By exploiting this flaw, an attacker can download media files without triggering the intended resource usage restrictions, which can exhaust disk space and cause a denial of service due to disk space depletion.
The vulnerability requires low privileges and does not require user interaction, making it easier to exploit remotely.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves resource exhaustion caused by excessive media downloads bypassing safety limits on file size and count. Detection can focus on monitoring disk usage patterns and identifying unusually high numbers or large sizes of media files being downloaded by OpenClaw prior to version 2026.3.31.
Suggested detection methods include checking disk space usage and listing media files downloaded by OpenClaw to identify abnormal growth.
- Use disk usage commands such as `df -h` to monitor overall disk space.
- List large media files or count files in the media download directories, for example: `find /path/to/openclaw/media -type f -exec ls -lh {} + | sort -k5 -h` to find large files.
- Monitor the number of media files with `find /path/to/openclaw/media -type f | wc -l` to detect unusually high file counts.
- Check OpenClaw logs for repeated media download attempts or errors related to media handling.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade OpenClaw to version 2026.3.31 or later, where the vulnerability has been fixed by enforcing strict limits on media download size and count.
If upgrading immediately is not possible, consider limiting inbound media downloads manually by restricting file sizes and counts, and monitoring disk usage closely to prevent exhaustion.
- Apply the patch or update OpenClaw to version 2026.3.31 or newer.
- Implement disk quotas or limits on the directories used for media downloads.
- Monitor disk space and media file counts regularly to detect and stop potential abuse.
- Review and restrict user privileges to reduce the risk of exploitation, since the vulnerability requires low privileges but still partial attack complexity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability CVE-2026-41408 causes resource exhaustion by allowing attackers to bypass safety limits on media downloads, leading to disk space depletion and availability impact.
However, there is no information in the provided context or resources about any direct impact on compliance with common standards or regulations such as GDPR or HIPAA.