Sandboxed Session Bypass in OpenClaw Gateway by OpenClaw

CVE-2026-102806

What is CVE-2026-102806?

The vulnerability in OpenClaw prior to version 2026.9.5 introduces an incorrect authorization flaw within the Gateway's local media root allowlist. This issue compromises filesystem isolation across sandboxed sessions, leading to potential unauthorized file access from neighboring session sandboxes or shared workspace directories. Sandboxed sessions expose themselves to risks where untrusted content may enable the Gateway to access files from other active sessions through compromised media pipeline functions.

References