OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling… (CVE-2026-100538)
OpenClaw npm package versions before 2026.8.1 do not enforce the originating sender's global or per-agent toolsBySender policy when processing outbound attachments. This allows a sender who is denied filesystem read tools to still cause a known local file to be read and sent back via a media directive or message attachment. Exploitation requires knowledge of a valid host file path and a delivery flow that accepts local attachments. The vulnerability is fixed in version 2026.8.1.
AI Analysis
Technical Summary
The OpenClaw npm package prior to version 2026.8.1 fails to apply the toolsBySender policy for outbound attachments, enabling a sender without filesystem read permissions to read and disclose local file contents. This occurs because the policy controlling which tools a sender can use is not enforced when handling outbound attachments, allowing unauthorized local file reads to be returned in responses. Exploitation requires the attacker to know or derive a useful file path on the host and to have a delivery flow that accepts local attachments. The issue is addressed in version 2026.8.1.
Potential Impact
An attacker with limited privileges who is explicitly denied filesystem read tools can still cause local files to be read and disclosed to an authorized requester. This leads to unauthorized disclosure of local file contents, impacting confidentiality. There is no impact on integrity or availability. Exploitation requires some level of privilege (PR:L) and no user interaction (UI:N).
Mitigation Recommendations
Upgrade to OpenClaw version 2026.8.1 or later, where this issue is fixed. No other mitigation is indicated or required.
OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling… (CVE-2026-100538)
Description
OpenClaw npm package versions before 2026.8.1 do not enforce the originating sender's global or per-agent toolsBySender policy when processing outbound attachments. This allows a sender who is denied filesystem read tools to still cause a known local file to be read and sent back via a media directive or message attachment. Exploitation requires knowledge of a valid host file path and a delivery flow that accepts local attachments. The vulnerability is fixed in version 2026.8.1.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw npm package prior to version 2026.8.1 fails to apply the toolsBySender policy for outbound attachments, enabling a sender without filesystem read permissions to read and disclose local file contents. This occurs because the policy controlling which tools a sender can use is not enforced when handling outbound attachments, allowing unauthorized local file reads to be returned in responses. Exploitation requires the attacker to know or derive a useful file path on the host and to have a delivery flow that accepts local attachments. The issue is addressed in version 2026.8.1.
Potential Impact
An attacker with limited privileges who is explicitly denied filesystem read tools can still cause local files to be read and disclosed to an authorized requester. This leads to unauthorized disclosure of local file contents, impacting confidentiality. There is no impact on integrity or availability. Exploitation requires some level of privilege (PR:L) and no user interaction (UI:N).
Mitigation Recommendations
Upgrade to OpenClaw version 2026.8.1 or later, where this issue is fixed. No other mitigation is indicated or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m2g4-5ff5-4cf5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100538"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ab74f2df7a7c54106e13848
Added to database: 09/26/2026, 04:50:53 UTC
Last enriched: 09/26/2026, 04:56:03 UTC
Last updated: 09/27/2026, 01:47:40 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.