CVE-2026-100547

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100547
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100547.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100547
Aliases
  • GHSA-356g-m7rx-7pm3
Published
2026-09-26T02:18:43Z
Modified
2026-09-27T03:30:36Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw before 2026.8.1 Authentication Bypass via File URL
Details

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions (2026.7.1 through 2026.7.2), alternate but valid file: URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly classified as reads scoped to the session working directory. When an operator connected openclaw acp client to an untrusted or compromised ACP peer, that peer could request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. This issue is fixed in OpenClaw 2026.8.1.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-180"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100547.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0790d9f593ad30c940ed93b5872a8cf6d6f3cf8c
Fixed
ea806575e6450e4d1efdfc72c19f04be982a1b9b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2026.7.1-2"
        },
        {
            "fixed":  "2026.8.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100547.json"