OpenClaw CVE-2026-44111

Exploitation requires authenticated access to the OpenClaw instance with privileges to invoke the memory tool (PR:L indicates low-privilege authenticated access). The QMD backend must be enabled in the OpenClaw configuration. The attacker must target only Markdown files (*.md extensions) located within the workspace root directory; files outside the workspace root cannot be accessed. The vulnerability is specific to the memory_get function in the QMD backend and does not affect other OpenClaw tools or backends. Importantly, this is not a default configuration vulnerability-exploitation is limited to instances where the memory tool and QMD backend are both active and accessible to the attacker.

The CVSS 2.3 score with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:X reflects low overall risk due to multiple mitigating factors. Exploitation requires authenticated access (PR:L), meaning the attacker must possess valid credentials or an established session with the OpenClaw instance. The attack vector is network-accessible, but the attack complexity is listed as low with an attack time parameter (AT:P) suggesting time-based complexity. The integrity impact is low (VC:L), limited to unauthorized reading of Markdown files within the workspace scope-not system-wide file access. No integrity, availability, or scope changes occur. The absence of EPSS data, KEV status, or confirmed public exploit code suggests this is a low-priority, policy-bypass vulnerability rather than an urgent remote code execution or authentication-bypass threat. Real-world risk depends heavily on whether the affected organization has restricted memory tool access to trusted users; if widely accessible, the risk increases moderately. The limiting factors-authentication requirement and workspace-boundary containment-prevent this from being a critical finding, but organizations should still prioritize patching to enforce intended access policies.

An authenticated user with access to OpenClaw's memory tool identifies that the QMD backend accepts arbitrary workspace Markdown file paths. The attacker constructs a memory_get request with a path such as '../sensitive-docs.md' or 'config.md' to read files outside the canonical memory directory structure. Because the original implementation only validated that paths remained within the workspace root, the read succeeds and returns the contents of the arbitrary Markdown file, bypassing the intended restriction to canonical or indexed memory files.