OpenClaw CVE-2026-100547

Exploitation requires that the operator run openclaw acp client and connect it to an untrusted or compromised Agent Client Protocol (ACP) peer - the peer is the attacker. It only affects OpenClaw versions 2026.7.1 through 2026.7.2 (fixed in 2026.8.1). The limiting factors are significant: the vector is local via the ACP session (AV:L), it depends on operator action to establish the connection (UI:P), and impact is bounded strictly to reading file contents outside the session working directory - mutating and command-capable tool classes are explicitly unaffected, so there is no write, execution, or availability impact.

This is a genuine but low-priority finding. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) correctly captures a locally-triggered, confidentiality-only weakness: the attack path is not remote-over-network in the classic sense but rides the local Agent Client Protocol (ACP) channel, and it requires an operator to actively connect openclaw acp client to a malicious/compromised peer (UI:P). No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict here - every indicator (local vector, required user interaction, confidentiality-only impact, niche OSS product, no exploitation evidence) points the same low-urgency direction. Note one labeling nuance: the VulnCheck advisory titles this an 'authentication bypass via file URL,' but the actual weakness (CWE-180, validate-before-canonicalize) is a path-normalization/authorization-scope bypass, not credential-based auth bypass; the assigned 'Information Disclosure' tag is the more accurate characterization. This is a real fix-worthy bug for OpenClaw operators using ACP, not a widespread emergency.

An operator connects their OpenClaw instance to a third-party or compromised ACP peer (e.g., an untrusted editor/agent integration). The malicious peer sends a read request using an alternate-but-valid file: URL spelling that OpenClaw mis-parses as a relative path inside the session working directory, bypassing the approval prompt that would normally guard out-of-scope reads, and exfiltrates the contents of a sensitive file (e.g., SSH keys or credentials) outside the working directory. No public exploit code is identified, but the demonstrated impact is file-content disclosure only.