CVE-2026-102806

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102806
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102806.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102806
Published
2026-09-29T17:22:39Z
Modified
2026-10-01T03:47:30Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
Details

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared workspace directories through media pipeline functions that fail to restrict reads to the active session.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102806.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ec9c1a13db8938e5a3eaa51fca2e981cde2395a9
Fixed
fca04893b5b337d2eb70a6ba41f03fc8e33eff83
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.9.5"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other
release-publish/009f929485ce-1788834848
release-publish/014031692483-1788866744
release-publish/088d0f5b8755-1789111799
release-publish/08987d8f409b-20260717
release-publish/0e9db600595-20260717
release-publish/0e9db6005954-20260717
release-publish/0f7fbfa0039f-20260715
release-publish/10a390ed7fa8-20260802
release-publish/135d2700e7b6-1788829835
release-publish/17a1225314cd-1787924262
release-publish/1a4d9a0340da-1788864350
release-publish/1c80cf86cfd0-1787823217
release-publish/1d2777548d01-20260715
release-publish/2133a924eef0-1787945469
release-publish/21b41efc7bb8-1787818100
release-publish/23d2f664fb75-20260715
release-publish/31c0ccedfe05-33460424250
release-publish/38fd9ad6e417-1787824804
release-publish/3952c695cb49-33340032114
release-publish/3d99a7f08e26-33333262829
release-publish/404719374e60-1787933925
release-publish/4074a8b44d89-1787849600
release-publish/428fa8e0d3da-1788453684
release-publish/458f9980c2bf-1789080487
release-publish/45ed68e6ea62-1787220256
release-publish/468054f93c43-1787921799
release-publish/479510607f01-33325118232
release-publish/4916ca25bfe3-1788491092
release-publish/491769bded58-1787929537
release-publish/5090935817e3-1787842724
release-publish/54183c0c9688-33471448769
release-publish/54f70c5d8c04-20260715
release-publish/556a2ee276f0-20260718
release-publish/57d8e21ccea0-33525047092
release-publish/57fabb2c9c35-1786621048
release-publish/5cb2eee257bc-1787929587
release-publish/5cb2eee257bc-1787929714
release-publish/5dca33a8fb67-20260802
release-publish/6107afa77d77-33347278689
release-publish/62c77b0fb51c-1787927225
release-publish/6ddb9f049fb3-1787938179
release-publish/705500c6fa08-1789374404
release-publish/716f996be8db-1786550775
release-publish/728084497329-20260801
release-publish/73d04395defe-20260717
release-publish/7444f28d2dc5-1789076455
release-publish/7c9794b5c65c-20260801
release-publish/830c2eed4302-1788853324
release-publish/8371831eba5e-1786610071
release-publish/8858944a81c5-20260717
release-publish/8afa8f339eb6-1787798436
release-publish/8e7837840763-1788451538
release-publish/8fc5024659a9-33487439567
release-publish/9b80f9a8b1df-20260717
release-publish/9bc3c2955500-20260802
release-publish/a33c8a5c0ec6-1787896022
release-publish/a84a915b67bd-1787933964
release-publish/a9ac13b2efd7-20260717
release-publish/ab170d5fe879-33457206751
release-publish/abd63c06c2f5-1786646045
release-publish/b3986403ddb9-1787938102
release-publish/b754503dacc7-33519866838
release-publish/bb1a7e506927-20260715
release-publish/bccb649077f0-1787900300
release-publish/bcecb3d1d19a-1788627709
release-publish/bcfe3383b87d-1789403363
release-publish/c28c279afa37-1787225611
release-publish/c3927271fad7-20260715
release-publish/c96e81375014-1787462685
release-publish/ce9ef22169f5-33473514087
release-publish/ced50f88e928-20260717
release-publish/d0c0a2c229b0-1788632460
release-publish/d0c8f02d99b4-33442491455
release-publish/d5412d73acfb-1787906286
release-publish/d84cdc5c03d3-1788488705
release-publish/d8b3e1c093f2-20260715
release-publish/d8dd59bf8f60-20260717
release-publish/deffca656500-20260801
release-publish/dfa246e6fd16-20260715
release-publish/e11c566824b1-1787940135
release-publish/eb8c22ed13f9-20260801
release-publish/ebc70fa1b3f6-1787634336
release-publish/f4987deb94b8-1786361493
release-publish/f4f5bb15d46a-20260715
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v1.*
v1.0.4
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v2.*
v2.0.0-beta1
v2.0.0-beta2
v2.0.0-beta3
v2.0.0-beta4
v2.0.0-beta5
v2026.*
v2026.1.10
v2026.1.11
v2026.1.11-1
v2026.1.11-2
v2026.1.11-3
v2026.1.12
v2026.1.12-2
v2026.1.13
v2026.1.14-1
v2026.1.15
v2026.1.16-2
v2026.1.20
v2026.1.21
v2026.1.22
v2026.1.23
v2026.1.24
v2026.1.24-1
v2026.1.29
v2026.1.30
v2026.1.5
v2026.1.5-1
v2026.1.5-2
v2026.1.5-3
v2026.1.8
v2026.1.9
v2026.2.1
v2026.2.12
v2026.2.13
v2026.2.14
v2026.2.15-beta.1
v2026.2.17
v2026.2.19
v2026.2.19-beta.1
v2026.2.2
v2026.2.21
v2026.2.21-beta.1
v2026.2.22
v2026.2.22-beta.1
v2026.2.23
v2026.2.23-beta.1
v2026.2.24
v2026.2.24-beta.1
v2026.2.25
v2026.2.25-beta.1
v2026.2.26
v2026.2.26-beta.1
v2026.2.3
v2026.2.6
v2026.2.6-1
v2026.2.6-2
v2026.2.6-3
v2026.2.9
v2026.3.1
v2026.3.11
v2026.3.11-beta.1
v2026.3.12
v2026.3.13
v2026.3.13-1
v2026.3.2
v2026.3.2-beta.1
v2026.3.22
v2026.3.22-beta.1
v2026.3.23
v2026.3.23-2
v2026.3.23-beta.1
v2026.3.24
v2026.3.24-beta.1
v2026.3.24-beta.2
v2026.3.28
v2026.3.28-beta.1
v2026.3.31
v2026.3.31-beta.1
v2026.3.7
v2026.3.7-beta.1
v2026.3.8
v2026.3.8-beta.1
v2026.4.1
v2026.4.1-beta.1
v2026.4.10
v2026.4.11
v2026.4.11-beta.1
v2026.4.12
v2026.4.12-beta.1
v2026.4.14
v2026.4.14-beta.1
v2026.4.15
v2026.4.15-beta.1
v2026.4.15-beta.2
v2026.4.19-beta.1
v2026.4.19-beta.2
v2026.4.2
v2026.4.5
v2026.4.7
v2026.4.7-1
v2026.4.8
v2026.4.9
v2026.4.9-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102806.json"