Openclaw CVE-2026-27522

The CVSS 3.1 score of 6.5 reflects a medium-to-high severity profile with significant real-world risk. The attack vector is network-based (AV:N) with low complexity (AC:L), but requires valid authentication (PR:L), limiting initial attack surface to authenticated users. The impact is confidentiality breach (C:H) with no integrity or availability impact (I:N/A:N), meaning attackers can exfiltrate sensitive files but cannot modify or disrupt systems. The authentication requirement significantly reduces exploit probability compared to unauthenticated vulnerabilities, but the ease of exploitation (low complexity) and file read capability remain concerning. Patch availability is confirmed via GitHub commit 270ab03e379f9653e15f7033c9830399b66b7e51, reducing urgency for organizations with patch management processes in place. The ENISA EUVD tracking and VulnCheck reporting indicate this is a recognized threat in enterprise environments. Real-world priority depends on: (1) whether OpenClaw is internet-exposed with user account provisioning, (2) what sensitive files are readable by the runtime user (database credentials, private keys, configuration), and (3) whether sandboxRoot misconfiguration is prevalent in deployed instances.

An authenticated user with valid OpenClaw credentials discovers that the application does not properly validate file paths in the sendAttachment action. The attacker crafts a message containing an absolute path (e.g., /etc/passwd or /root/.ssh/id_rsa) instead of a relative media file reference. Since sandboxRoot is unset in the target deployment, the application attempts to read the attacker-specified absolute path and attaches it to the message, allowing the attacker to exfiltrate the file contents. The low complexity and network accessibility of this attack make it trivial to automate against multiple OpenClaw instances once discovered.