The vulnerability exists in OpenClaw prior to version 2026.9.5 and allows an authorization bypass in the Gateway’s media root allowlist. This flaw permits sandboxed or untrusted sessions to read files located in sibling sandbox directories or the shared workspace through media pipeline functions that do not constrain access to the active session. The flaw is categorized as CWE-863, indicating an improper authorization mechanism.

Products affected are OpenClaw:OpenClaw. Any installation of OpenClaw earlier than version 2026.9.5 is vulnerable. The fix is included in release 2026.9.5 and later.

The CVSS score of 6.0 indicates moderate severity. Because the EPSS score is not available, the exploitation probability cannot be precisely quantified, but the absence of KEV listing suggests no confirmed active exploitation yet. An attacker can potentially pose as a trusted user or create a sandboxed session, which allows reading sensitive files. The attack vector is likely local or via the gateway interface, and requires that the attacker can inject media content or control session creation. Because the vulnerability breaches filesystem isolation, the impact can lead to data disclosure of confidential files within the sandboxed environment.