Executive brief
OpenClaw is an AI automation platform that includes a browser control feature for authenticated users. A vulnerability in its navigation guard allowed authenticated users to bypass restrictions and access local files on the server via file:// URLs, potentially exposing configuration files, secrets, and other sensitive data readable by the OpenClaw process.
Technical details
The vulnerability exists in the assertBrowserNavigationAllowed() function in src/browser/navigation-guard.ts, which only explicitly validated http: and https: schemes but allowed all other URL schemes including file:, data:, and javascript:. An authenticated gateway user with browser-tool access could invoke browser navigation to file:// URLs (e.g., file:///etc/passwd) and extract page content via browser snapshot/extraction flows to read local files. The attack requires valid gateway credentials and browser-tool capability to be enabled; no user interaction is needed once authenticated. An attacker can exfiltrate any files readable by the OpenClaw process user, including configuration and secrets. The fix blocks non-network schemes while preserving about:blank, and is available in version 2026.2.21.
Affected products
- OpenClaw openclaw <= 2026.2.19-2
Timeline
- 2026-03-03: disclosed: Advisory published
- 2026-02-21: patched: Fix available in version 2026.2.21