Sender Policy Bypass Vulnerability in OpenClaw by OpenClaw

CVE-2026-42438

What is CVE-2026-42438?

OpenClaw versions earlier than 2026.4.10 contain a vulnerability that allows attackers to bypass sender and group-scoped authorization, leading to potential unauthorized access to local files. This is achieved through a flaw in the outbound host-media attachment read functionality, which does not enforce proper access controls for users denied read access via toolsBySender or group policy. As a result, malicious actors can exploit this weakness to load host media attachments and retrieve sensitive files from the local system.

References