OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthori…

Published:

4 mei 2026 om 22:00:00

Alert date:

5 mei 2026 om 13:07:56

Source:

nvd.nist.gov

Identity & Access, Data Breach & Exfiltration

CVE-2026-42438 affects OpenClaw versions 2026.4.9 before 2026.4.10, containing a sender policy bypass vulnerability in the outbound host-media attachment read helper. This vulnerability allows unauthorized local file disclosure where attackers with denied read access via toolsBySender or group policy can trigger host-media attachment loading. The flaw enables bypassing sender and group-scoped authorization boundaries to retrieve readable local files through the outbound media path. The vulnerability has been patched in version 2026.4.10 with fixes available through GitHub commits and security advisories.

Technical details

Mitigation steps:

Affected products:

OpenClaw