Executive brief
OpenClaw is an AI agent platform that integrates with external tool servers using the Model Context Protocol (MCP). A malicious or compromised tool server can inject file path directives into tool results, causing OpenClaw to read and exfiltrate arbitrary files from the host system—particularly sensitive data stored in temporary directories—to external messaging channels like Discord and Slack without user awareness.
Technical details
The vulnerability is a path traversal and information disclosure flaw in OpenClaw's media processing pipeline. The extractToolResultMediaPaths() function parses MEDIA: directives from MCP tool result text without validating the source or destination, and passes them to assertLocalMediaAllowed() which checks against a default allowlist that includes os.tmpdir() (e.g., /tmp on Linux/macOS, %TEMP% on Windows). Since these directories are world-readable and often contain application secrets, database dumps, and credentials, an attacker controlling an MCP tool server can inject paths like "MEDIA:/tmp/app-secrets.env" or use alternative vectors (details.path fallback, file:// URIs) to read arbitrary files. After validation passes, readLocalFileSafely() reads the file and delivers its contents as media attachments to Discord, Slack, Telegram, and WhatsApp channels, exfiltrating data silently. The attack requires network access to the MCP tool connection but no user interaction if auto-reply is enabled. Patches are available in version 2026.2.21 and later.
Affected products
- OpenClaw OpenClaw <= 2026.2.19-2
Timeline
- 2026-03-04: disclosed
- 2026-02-21: patched: Version 2026.2.21 and later contain patches