OpenClaw before 2026.7.1 contains an authorization bypass in the diagnostics export command that allows non‑owner channel senders to request and receive diagnostic bundles intended only for owners. The attacker can obtain detailed host configuration, runtime state, and connected services information, potentially aiding further exploitation. The flaw is classified as Information Exposure (CWE‑200).

All installations of OpenClaw versions earlier than 2026.7.1 are impacted, regardless of operating environment, because the vulnerability resides in the diagnostics export functionality. Any host running these versions exposes diagnostic data to non‑owners.

The CVSS score of 7.1 indicates high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting no confirmed exploits yet. Exploitation requires an attacker to join a channel as a non‑owner and invoke the diagnostics export command; the resulting bundle is returned to the attacker. Given this straightforward attack path and the sensitive data exposed, the risk warrants prompt remediation.