CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL
An attacker controlling an ACP peer can bypass path restrictions to read local files outside the session directory in OpenClaw.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-100547?
CVE-2026-100547 is a medium-severity path traversal vulnerability in OpenClaw, published on 26 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly classified as reads scoped to the session working directory. When an operator connected `openclaw acp client` to an untrusted or compromised ACP peer, that peer could request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. This issue is fixed in OpenClaw 2026.8.1.
Weakness: CWE-180
Which versions are affected by CVE-2026-100547?
How do I fix CVE-2026-100547?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-100547 being exploited?
There is no known exploitation of CVE-2026-100547 in the wild and no public exploit code.
Sources
Also known as GHSA-356g-m7rx-7pm3, GHSA-3fp8-r6r3-vjcc, MINI-575f-fghc-9vxv.