Which versions of OpenClaw are affected by EUVD-2026-27259?

OpenClaw 2026.4.9 contains a local file disclosure vulnerability that allows authenticated users with restricted permissions to read arbitrary files on the host system, bypassing intended access…. A patch is available.

How to fix or mitigate EUVD-2026-27259?

Within 24 hours: Inventory all OpenClaw deployments and identify instances running versions prior to 2026.4.10. Within 7 days: Apply vendor-released patch to version 2026.4.10 (commit c949af9) across all affected systems, prioritizing multi-tenant production environments. Within 30 days: Audit access logs for suspicious media attachment requests from restricted user accounts and review file access patterns in affected deployments.

OpenClaw EUVD-2026-27259

Q: What is the CVSS score of EUVD-2026-27259?

EUVD-2026-27259 has a CVSS 4.0 base score of 4.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-42438 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-05 VulnCheck

Authentication Bypass Openclaw

4.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 05, 2026 - 12:37 NVD

HIGH MEDIUM

CVSS changed

May 05, 2026 - 12:37 NVD

7.7 (HIGH) 4.9 (MEDIUM)

Source Code Evidence Fetched

May 05, 2026 - 12:16 vuln.today

Analysis Generated

May 05, 2026 - 12:16 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.9.

DescriptionCVE.org

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file disclosure. Attackers with denied read access via toolsBySender or group policy can trigger host-media attachment loading to bypass sender and group-scoped authorization boundaries and retrieve readable local files through the outbound media path.

AnalysisAI

Unauthorized local file disclosure in OpenClaw 2026.4.9 allows authenticated attackers with restricted sender/group permissions to bypass policy controls and read arbitrary host files through the media attachment path. Despite sender-scoped 'toolsBySender' or group policy denying read access, the outbound host-media attachment helper failed to honor these restrictions, enabling privilege escalation within multi-tenant deployments. Vendor-released patch available in version 2026.4.10 (commit c949af9) threads sender context through media access resolution to enforce policy boundaries correctly.

Technical ContextAI

OpenClaw is an npm package implementing automated reply/agent workflows with file attachment capabilities. The vulnerability stems from CWE-863 (Incorrect Authorization) where the outbound host-media attachment read helper created file read capabilities at the global/agent scope without intersecting sender-scoped authorization context. The codebase previously passed 'requesterAccountId' through the media resolution chain but omitted 'requesterSenderId', 'requesterSenderName', 'requesterSenderUsername', and 'requesterSenderE164' fields needed to evaluate 'toolsBySender' and group policy. This created a policy enforcement mismatch: administrators could configure sender/group policies denying 'read' tool access, yet the media hydration codepath installed host readFile capabilities without checking those sender-specific restrictions. The CVSS scope change (S:C) reflects cross-boundary impact where a restricted sender can access resources outside their intended authorization domain.

RemediationAI

Upgrade to OpenClaw version 2026.4.10 or later, which threads sender, session, channel, and account context into outbound media access resolution and intersects host-media read capability creation with existing group tool policy for 'read' operations. Patch delivered via GitHub PR #64459, commit c949af9fabf3873b5b7c484090cb5f5ab6049a98, available at https://github.com/openclaw/openclaw/commit/c949af9fabf3873b5b7c484090cb5f5ab6049a98. For deployments unable to upgrade immediately, disable host-media attachment functionality at the global/agent level or remove filesystem root expansion permissions, though this eliminates legitimate attachment features. Alternatively, audit and remove sender/group-scoped 'toolsBySender' policies if all senders are equally trusted, converting to uniform global policy enforcement, but this widens the trust boundary and may not be acceptable in multi-tenant configurations. Review access logs for unexpected media attachment requests from restricted senders to identify potential exploitation. No effective workaround exists that preserves both host-media functionality and sender-scoped policy enforcement without upgrading.