Executive brief
OpenClaw is an AI platform that can perform actions on systems. A flaw in how it manages local media file access rules allows the AI model to read arbitrary files from the host system and steal credentials. The vulnerability exists in versions prior to 2026.3.31 and requires that the filesystem tool is already enabled; a patch is available and should be applied immediately.
Technical details
The vulnerability is a directory traversal / file access control bypass (CWE-552) in the appendLocalMediaParentRoots function (src/media/local-roots.ts). The root cause is that media parent directories are self-whitelisted without proper validation, enabling model-initiated arbitrary host file read when the tool-fs root expansion is permitted in configuration. An attacker can exploit this by triggering the AI model to access files outside intended boundaries. The vulnerability impacts confidentiality (file read) and can lead to credential exfiltration. The fix, committed 2026-03-30, ensures local roots remain configuration-derived and prevents unauthorized path expansion. Patch available in v2026.3.31.
Affected products
- OpenClaw openclaw <= 2026.3.28
Timeline
- 2026-04-03: disclosed: GHSA-57gh-m6rq-54cf published
- 2026-03-30: patched: Fix commit 1ca4261d7e055d0be141ed79ebb1365d0fbc7364
- 2026-03-31: other: Advisory published by maintainer