CVE-2026-26321: LFI in OpenClaw Node.js Extension

The primary impact of CVE-2026-26321 is the potential for unauthorized access to sensitive local files. An attacker who can influence tool calls, either directly or through prompt injection, can supply malicious mediaUrl values containing paths to critical system files, such as /etc/passwd or configuration files. Successful exploitation could lead to the disclosure of user credentials, system configurations, and other confidential data. The blast radius extends to any system where the vulnerable OpenClaw extension is deployed and accessible to an attacker.

1. Reserved2026-02-13
2. Published2026-02-17
3. Modified2026-02-20
4. EPSS updated2026-03-23

The recommended mitigation for CVE-2026-26321 is to immediately upgrade the OpenClaw extension to version 2026.2.14 or a later patched version. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing stricter input validation on the mediaUrl parameter to prevent the inclusion of arbitrary file paths. While not a complete solution, this can reduce the attack surface. Review and harden prompt injection defenses to prevent attackers from manipulating tool calls. After upgrading, confirm the fix by attempting to trigger the vulnerable functionality with a known malicious mediaUrl (e.g., /etc/passwd) and verifying that access is denied.