CVE-2026-100538 OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
Attackers can read local files by bypassing sender tool restrictions in OpenClaw, exposing sensitive data to unauthorized requesters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100538?
CVE-2026-100538 is a high-severity missing authorization vulnerability in OpenClaw, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a final-response media directive or a message attachment, disclosing local file contents to an admitted requester whose agent turn did not include the read tool. Exploitation requires knowledge or derivation of a useful host path and a delivery flow that accepts local attachments. The issue is fixed in version 2026.8.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-100538?
How do I fix CVE-2026-100538?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100538 being exploited?
There is no known exploitation of CVE-2026-100538 in the wild and no public exploit code.
Sources
Also known as GHSA-m2g4-5ff5-4cf5, GHSA-w5x7-c87m-3jpc, MINI-hmj2-92g5-v7hv.