CVE-2026-100547: OpenClaw before 2026.8.1 Authentication Bypass via File URL
OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions (2026.7.1 through 2026.7.2), alternate but valid file: URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly classified as reads scoped to the session working directory. When an operator connected openclaw acp client to an untrusted or compromised ACP peer, that peer could request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. This issue is fixed in OpenClaw 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Operators using OpenClaw versions 2026.7.1 through 2026.7.2 who connect the `openclaw acp client` to an untrusted or compromised ACP peer are exposed. The peer can cause local files outside the session working directory to be read without the normal approval prompt.
What does an attacker need to exploit it?
An attacker needs to control or compromise an ACP peer that an operator connects to with `openclaw acp client`. Exploitation also relies on the peer supplying alternate but valid `file:` URL spellings over ACP.
Are command execution or file modification capabilities affected?
No. The demonstrated impact is limited to disclosure of local file contents; mutating and command-capable tool classes are not affected.
What should be done if an immediate upgrade is not possible?
Do not connect `openclaw acp client` to untrusted ACP peers, and treat potentially compromised peers as untrusted. This prevents those peers from issuing the crafted file-read requests described in the advisory.
Which version fixes the issue?
OpenClaw 2026.8.1 fixes the issue.