OpenClaw is a coding agent distributed as the npm package openclaw. (CVE-2026-100547)
OpenClaw versions 2026.7.1 through 2026.7.2 have a vulnerability where alternate valid file: URL spellings sent over the Agent Client Protocol (ACP) are incorrectly treated as relative paths. This allows an untrusted or compromised ACP peer to read files outside the session working directory without user approval, leading to disclosure of local file contents. The issue affects file confidentiality only and does not impact integrity or availability. The vulnerability is fixed in OpenClaw 2026.8.1.
AI Analysis
Technical Summary
OpenClaw, distributed as the npm package 'openclaw', versions 2026.7.1 through 2026.7.2 improperly handle alternate but valid 'file:' URL spellings over the Agent Client Protocol (ACP). These URLs are treated as relative paths and incorrectly classified as reads scoped to the session working directory. Consequently, an operator connecting the 'openclaw acp client' to an untrusted or compromised ACP peer could have files outside the session directory read without the usual approval prompt. The vulnerability impacts confidentiality by disclosing local file contents. Mutating and command-capable tool classes are unaffected. The issue is resolved in version 2026.8.1.
Potential Impact
An attacker controlling or compromising an ACP peer can read arbitrary local files outside the session working directory without user approval, leading to confidentiality breaches. There is no impact on file integrity or availability, and no capability to execute commands or mutate files.
Mitigation Recommendations
This vulnerability is fixed in OpenClaw version 2026.8.1. Users should upgrade to this version or later to remediate the issue. No other mitigation steps are indicated.
OpenClaw is a coding agent distributed as the npm package openclaw. (CVE-2026-100547)
Description
OpenClaw versions 2026.7.1 through 2026.7.2 have a vulnerability where alternate valid file: URL spellings sent over the Agent Client Protocol (ACP) are incorrectly treated as relative paths. This allows an untrusted or compromised ACP peer to read files outside the session working directory without user approval, leading to disclosure of local file contents. The issue affects file confidentiality only and does not impact integrity or availability. The vulnerability is fixed in OpenClaw 2026.8.1.
CVSS v3.1
Score 5.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw, distributed as the npm package 'openclaw', versions 2026.7.1 through 2026.7.2 improperly handle alternate but valid 'file:' URL spellings over the Agent Client Protocol (ACP). These URLs are treated as relative paths and incorrectly classified as reads scoped to the session working directory. Consequently, an operator connecting the 'openclaw acp client' to an untrusted or compromised ACP peer could have files outside the session directory read without the usual approval prompt. The vulnerability impacts confidentiality by disclosing local file contents. Mutating and command-capable tool classes are unaffected. The issue is resolved in version 2026.8.1.
Potential Impact
An attacker controlling or compromising an ACP peer can read arbitrary local files outside the session working directory without user approval, leading to confidentiality breaches. There is no impact on file integrity or availability, and no capability to execute commands or mutate files.
Mitigation Recommendations
This vulnerability is fixed in OpenClaw version 2026.8.1. Users should upgrade to this version or later to remediate the issue. No other mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3fp8-r6r3-vjcc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100547"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ab74f2ff7a7c54106e1385b
Added to database: 09/26/2026, 04:50:55 UTC
Last enriched: 09/26/2026, 04:57:00 UTC
Last updated: 09/27/2026, 02:17:07 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.