OpenClaw CVE-2026-100538

Requires an already-admitted requester whose sender identity has been explicitly denied filesystem read tools via global or per-agent toolsBySender policy (PR:L). Exploitation further requires knowledge or derivation of a useful local host file path AND a delivery flow that accepts local attachments (final-response media directive or message attachment). Limited to OpenClaw deployments before 2026.8.1; impact is read-only disclosure of local file contents with no integrity or availability effect. Not exploitable by fully unauthenticated outsiders and not effective without a valid, resolvable host path.

This is an authorization-bypass information-disclosure flaw (CWE-863) rather than the 'Authentication Bypass' its tag implies. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is confidentiality-only with no integrity or availability impact, and PR:L confirms the attacker must be an already-admitted requester whose agent turn was explicitly denied filesystem read tools - so this is a privilege/policy escape by an authorized-but-restricted party, not remote unauthenticated compromise. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is 'no public exploit identified at time of analysis.' Real-world priority is tempered by concrete preconditions the description itself states: the attacker must know or derive a useful host file path and must have a delivery flow that accepts local attachments. Net: a legitimate but real confidentiality bypass in a niche open-source agent framework - MEDIUM at most, well below what a bare 7.1 might suggest, because exploitation is gated on prior admission plus path knowledge and yields read-only file disclosure.

An admitted but read-tool-denied sender crafts a message whose final-response media directive or attachment references a known local host path (e.g., a config or secrets file). OpenClaw fails to re-apply the sender's toolsBySender policy on the outbound attachment path, so it reads the file and returns its contents to the requester. No public exploit code is identified at time of analysis.