OpenClaw EUVD-2026-87514

Requires an OpenClaw deployment before 2026.8.1 with Telegram delivery configured/active, and an attacker able to submit structured message attachments to the agent (PR:L - a write-scoped caller or a steered agent turn, not fully anonymous). Exploitation specifically abuses attachments carrying multiple 'source' fields so an unvalidated absolute host path is hidden behind an allowed attachment source, defeating sandbox path validation. Limiting factors: the caller needs message-submission privilege, the Telegram delivery channel must be in use to carry the exfiltrated file out, and impact is confined to reading files already present on the host - no code execution, modification, or denial of service.

This is a genuine but moderate-priority information-disclosure flaw, not an overhyped high-CVSS item. The vendor CVSS4 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, score 7.1) is internally consistent: network-reachable, low complexity, but requiring some privilege (PR:L - an authenticated/write-scoped caller or steered agent able to submit structured message attachments), with impact confined to confidentiality (host file read/exfiltration) and no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or automated weaponization - real-world risk is currently 'no public exploit identified at time of analysis.' The PR:L requirement and the narrow confidentiality-only impact meaningfully cap real-world risk below what the 7.1 base score alone suggests; this is a targeted data-leak primitive against an operator's own host rather than a mass-exploitable RCE. No conflicting signals: the CVSS vector, CWE-22, and the description all agree the flaw is a sandbox path-validation bypass enabling arbitrary host file disclosure.

An attacker who can submit structured messages to an OpenClaw agent crafts an attachment containing multiple 'source' fields, placing an allowed sandbox source alongside a hidden absolute host path (e.g., an SSH key, token file, or config). Because OpenClaw validates only some source fields, the unvalidated host path slips past the sandbox check and the Telegram delivery path reads and transmits the sensitive file to the attacker. No public exploit code is identified, but the multi-source-field trick is straightforward once the field-parsing weakness is known.