CVE-2026-42438
OpenClaw Sender Policy Bypass Allows Local File Disclosure
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.4.10 (exc) |
| openclaw | openclaw | 2026.4.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the sender policy bypass vulnerability in OpenClaw affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper. This flaw allows attackers who have restricted read access via toolsBySender or group policy to bypass sender and group-scoped authorization boundaries.
By triggering host-media attachment loading, these attackers can retrieve readable local files through the outbound media path, leading to unauthorized local file disclosure.
The vulnerability is classified under CWE-863 (Incorrect Authorization) and was fixed in version 2026.4.10.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited read permissions to bypass sender and group policy restrictions and access local files that should be protected.
Such unauthorized local file disclosure can lead to exposure of sensitive or confidential information stored on the affected system.
Because the attacker can retrieve files through the outbound media path, this could result in data leakage outside the intended security boundaries.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should immediately update OpenClaw to version 2026.4.10 or later, where the issue has been fixed.
The fix ensures proper enforcement of sender identity and policy during outbound host-media attachment reads, preventing unauthorized local file disclosure.
Applying this patch will close the sender policy bypass and restore correct authorization boundaries.