Threats tagged 'ghsa-jhpv-5j76-m56h'

OpenClaw versions 2026.4.9 up to but not including 2026.4.10 contain a vulnerability where sender and group-scoped read policies are bypassed in host media attachment reads. This allows a sender denied read access by policy to still trigger local file reads via outbound media, potentially disclosing host-local files accessible by the OpenClaw process. The issue arises from a mismatch in policy enforcement between sender/group restrictions and the host-media read helper. The vulnerability is fixed in version 2026.4.10.