CVE-2026-100547 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly classified as reads scoped to the session working directory. When an operator connected `openclaw acp client` to an untrusted or compromised ACP peer, that peer could request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. This issue is fixed in OpenClaw 2026.8.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within the OpenClaw coding agent, specifically affecting versions from 2026.7.1 through 2026.7.2, represents a critical path traversal and authorization bypass flaw rooted in improper input validation of file system access requests. This security defect manifests when an operator utilizes the Agent Client Protocol to connect the openclaw acp client to an external peer. The core technical failure lies in how the application processes alternate but syntactically valid spellings of file scheme URLs, commonly referred to as file: URIs. Instead of correctly interpreting these inputs as absolute paths or validating them against a strict allowlist, the software erroneously treats them as relative paths scoped exclusively to the session working directory. This misclassification allows an attacker who controls the ACP peer to craft specific requests that bypass the intended security boundaries designed to restrict file access to local directories only.
From an operational perspective, this flaw enables unauthorized disclosure of sensitive information residing on the host system outside the designated sandbox or working directory. When a compromised or untrusted ACP peer sends these malformed file: URL requests, OpenClaw fails to trigger the mandatory approval prompt that is normally required for accessing files beyond the immediate session context. Consequently, the agent proceeds to read and return the contents of arbitrary local files without user consent or verification. The impact is strictly limited to confidentiality, as the vulnerability does not extend to mutating file systems or executing commands through tool classes, thereby preventing direct remote code execution but still posing a significant risk for data exfiltration in environments where sensitive configuration files, credentials, or source code are stored outside the working directory.
This issue aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection principles related to path traversal, although it is specifically categorized under unauthorized access due to insufficient validation of resource identifiers. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1530 Data from Local System which involves accessing data stored on local systems without proper authorization. The vulnerability highlights the dangers inherent in trusting inputs received over network protocols like ACP without rigorous sanitization and schema enforcement. Attackers can leverage this flaw to perform reconnaissance or steal sensitive artifacts by exploiting the gap between expected URI parsing logic and actual file system resolution mechanisms within the agent's architecture.
To mitigate this risk, organizations must immediately upgrade OpenClaw to version 2026.8.1 where the path validation logic has been corrected to properly handle all valid spellings of file: URLs and enforce strict scoping rules regardless of input formatting. Until an update is applied, operators should restrict connections from untrusted ACP peers and ensure that sensitive data is not stored in locations accessible via relative path resolution if such access cannot be strictly controlled. Additionally implementing network-level controls to limit exposure of the Agent Client Protocol interface can reduce the attack surface available for exploitation by malicious actors attempting to probe these validation weaknesses.