Executive brief
OpenClaw is a framework for building AI-powered applications with memory and search capabilities. A flaw in the QMD backend allowed authorized users to read arbitrary Markdown files within the workspace, bypassing intended access controls that restrict memory reads to canonical or indexed paths only.
Technical details
The vulnerability is a path traversal / improper access control flaw (CWE-22) in the QMD backend's memory_get read path. The root cause is insufficient validation in qmd-manager.ts, which accepted arbitrary workspace Markdown paths without restricting them to canonical memory locations or previously indexed QMD results. Attack precondition: an authenticated caller must have access to the memory_get tool. Impact: an attacker can read arbitrary .md files within the workspace root, bypassing memory-path policy. The fix, released in version 2026.4.15, adds validation to reject non-canonical and non-indexed workspace Markdown paths.
Affected products
- OpenClaw OpenClaw < 2026.4.15
Timeline
- 2026-04-17: disclosed
- 2026-04-15: patched: Version 2026.4.15 released with fix