Vulnerability · Published May 5, 2026 · Assigned by VulnCheck

CVE-2026-42438OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads

High 7.7

In plain English

A high-severity incorrect authorization in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 85.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file disclosure. Attackers with denied read access via toolsBySender or group policy can trigger host-media attachment loading to bypass sender and group-scoped authorization boundaries and retrieve readable local files through the outbound media path.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	openclaw	2026.4.10	GHSA-jhpv-5j76-m56h

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	2026.4.9 – before 2026.4.10

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-jhpv-5j76-m56h) vendor-advisory
Patch Commit patch
VulnCheck Advisory: OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads third-party-advisory