OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation in the assertBrowserNavigationAllowed() function. This allows authenticated users who have browser‑tool access to navigate to file:// URLs. By doing so, attackers can read local files that are accessible to the OpenClaw process user. The leaked files can be captured through browser snapshot and extraction actions, enabling exfiltration of sensitive data. The vulnerability is a CWE‑610 (Improper Restriction of Operations within the Bounds of a Memory Buffer) incident that primarily impacts confidentiality.

The affected product is OpenClaw from vendor OpenClaw. Versions prior to 2026.2.21 are impacted. No additional version qualifiers are provided in the CNA data.

The CVSS score is 7.1, indicating a high severity level. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. The attack vector requires authenticated access and the presence of browser‑tool capabilities, limiting the attack surface to legitimate users of the application. Nonetheless, the high severity score and the potential for sensitive data leakage make this vulnerability a high priority for remediation.