Openclaw cli: OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection

OpenClaw CLI's tool result processing pipeline extracts file paths from MEDIA: tokens in MCP tool result text without validating the source or restricting paths beyond an allowlist that includes the OS temporary directory (os.tmpdir()). This allows a malicious MCP tool server to inject MEDIA: directives referencing arbitrary files within allowed directories, which OpenClaw then reads and sends as attachments to external messaging platforms such as Discord, Slack, Telegram, and WhatsApp. The vulnerability also supports alternative attack vectors via image content blocks with details.path fields and file:// URI schemes. The default allowlist's inclusion of os.tmpdir() is problematic because temporary directories often contain sensitive secrets and application data. The vulnerability affects all OpenClaw versions up to 2026.7.1. Exploitation results in silent exfiltration of local files to attacker-controlled channels without user notification. A patch is available to fix this issue.

An attacker controlling or compromising an MCP tool server can exfiltrate arbitrary files located within the OS temporary directory or OpenClaw state directories by injecting MEDIA: directives or manipulating image content paths. This leads to theft of sensitive information such as API keys, database credentials, SSH keys, session tokens, and other application secrets stored in temporary files. The exfiltration occurs silently via external messaging channels configured in OpenClaw, enabling attackers to receive stolen data without user awareness. Automated exploitation is possible if auto-reply features are enabled. This compromises confidentiality and may facilitate further attacks.

A patch is available for this vulnerability. Users should apply the official fix from the vendor to prevent local file exfiltration via MEDIA: directives. Until patched, users should consider restricting or monitoring the use of MCP tools from untrusted sources and review configurations of external messaging channels to limit exposure. No additional generic mitigations are recommended beyond applying the vendor's patch.