OpenClaw versions prior to 2026.3.31 have a resource exhaustion vulnerability that allows an attacker to download media without triggering the core safety limits for file size, count, and cleanup operations. This flaw, classified as CWE‑770, enables an adversary to consume disk space at an arbitrary rate, eventually exhausting storage on the host and disrupting legitimate application and service operations.

All installations of OpenClaw running a release earlier than 2026.3.31 are affected. The vulnerability is embedded in the media download handling routine and therefore applies to every server running those versions, regardless of platform or configuration details.

The CVSS score of 2.3 indicates a low overall severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a modest likelihood of exploitation. The flaw can be triggered by accessing the media download endpoint. Based on the description, it is inferred that the download functionality is reachable, but no specific authentication status is mentioned, so the endpoint could potentially be accessed without credentials. Once exploited, an attacker can gradually consume disk capacity until the system becomes unavailable, leading to a denial of service.