OpenClaw CVE-2026-102806

Requires an OpenClaw deployment running multiple sandboxed sessions (or processing untrusted content) that share a Gateway host, with the media pipeline / media-understanding attachment functions in use. The attacker must control a sandboxed session (PR:L) and cause the Gateway to resolve a media/attachment path against the overbroad local-root allowlist that includes shared workspace or sibling-sandbox parent directories. Exploitation is limited to reading files (confidentiality only - no write or DoS), is gated by an attack requirement (AT:P) that the media staging path be exercised, and does not apply to single-session or non-sandboxed deployments. Patched in 2026.9.5, which fails closed when a session's workspace is not mounted (workspaceAccess 'none').

This is a genuine but bounded confidentiality issue rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) scores 6.0 (Medium): network-reachable but gated by an attack requirement (AT:P) and requiring low privileges (PR:L), with high confidentiality impact and zero integrity/availability impact - consistent with an incorrect-authorization (CWE-863) cross-session file-read. No EPSS score, KEV listing, or public POC is present in the supplied data, so exploitation is currently theoretical: no public exploit identified at time of analysis. The PR:L is credible because the attacker must already control a sandboxed session (or route untrusted content through it); this is a privilege-escalation-of-data-access within an already-multi-tenant/sandboxed deployment, not a drive-by remote read. No conflicting signals across sources: description, CWE-863, and the CVSS impact profile (confidentiality-only) all align, and the linked PR diff confirms the root cause (default local-path roots re-merged the shared workspace/sandbox parents, defeating per-session scoping). Realistic priority is Medium - meaningful only for operators running OpenClaw with multiple untrusted sandboxed sessions sharing a Gateway.

An attacker who controls one sandboxed OpenClaw session (or can feed untrusted content into it) references a media/attachment path pointing at a sibling session's sandbox or the shared workspace. Because the Gateway's local media-root allowlist fails to restrict reads to the active session, the media pipeline reads and returns that cross-session file, disclosing another tenant's data. No public exploit is known, and exploitation requires the media-understanding/attachment pipeline to be exercised (AT:P), so it is not a trivial one-shot remote read.