CVE-2026-100538: OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a final-response media directive or a message attachment, disclosing local file contents to an admitted requester whose agent turn did not include the read tool. Exploitation requires knowledge or derivation of a useful host path and a delivery flow that accepts local attachments. The issue is fixed in version 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running the npm package openclaw before 2026.8.1 are exposed if they use delivery flows that accept local attachments. The risk is specifically relevant where senders are admitted but have been denied filesystem read tools through global or per-agent toolsBySender policy.
What does an attacker need to exploit it?
The attacker needs to be an admitted sender, know or derive a useful local host path, and use a delivery flow that accepts local attachments. They can cause the file to be returned through a final-response media directive or a message attachment despite the sender's filesystem-read restriction.
Are default configurations affected?
The available information does not state whether default configurations enable a delivery flow that accepts local attachments. Exposure depends on whether such a flow is available and whether the deployment runs a version before 2026.8.1.
What should be done if immediate patching is not possible?
Restrict or disable delivery flows that accept local attachments where possible, especially for admitted senders denied filesystem read access. This reduces the affected path until upgrading to 2026.8.1.