OpenClaw, the npm‑based coding agent, treated alternate but valid "file:" URLs sent through its Agent Client Protocol as relative paths. This misinterpretation enabled an operator who connected the client to an untrusted or compromised ACP peer to request and read files outside the session working directory without the normal approval prompt. The flaw therefore permits disclosure of local file contents, compromising confidentiality, but does not allow modification or execution of code. The weakness is a Boundary Enforcement failure (CWE‑180).

The issue impacts the OpenClaw product released through npm under the name openclaw. Versions 2026.7.1 and 2026.7.2 contain the vulnerability. It was remediated in OpenClaw 2026.8.1. Any deployment using the affected releases should be considered vulnerable.

The CVSS score of 6.8 indicates a moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Exfiltration requires an operator to run the client and connect to a malicious ACP peer; once the connection is established, the peer can request a file read that bypasses approval. No elevated privileges are required beyond ordinary operator use, so the attack vector is likely local or remote if the operator’s machine can be accessed. Consequently, the vulnerability is potentially exploitable in environments where operators allow connections to untrusted peers.