{"id":"CVE-2026-100538","published":"2026-09-26T03:16:59.537","lastModified":"2026-09-28T18:17:12.070","description":"OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a final-response media directive or a message attachment, disclosing local file contents to an admitted requester whose agent turn did not include the read tool. Exploitation requires knowledge or derivation of a useful host path and a delivery flow that accepts local attachments. The issue is fixed in version 2026.8.1.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5x7-c87m-3jpc","tags":[]},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-local-file-read-via-outbound-attachments","tags":[]}],"exploitRefs":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5x7-c87m-3jpc","tags":[]}],"hasPoc":true,"ai":null}