Sandbox Media Normalization Bypass in OpenClaw by OpenClaw
CVE-2026-43532

4.9MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
5 May 2026

What is CVE-2026-43532?

OpenClaw versions 2026.4.7 through 2026.4.9 contain a vulnerability where the application fails to properly normalize the parameters for Discord event cover images during sandbox media processing. This flaw allows an attacker to bypass essential media normalization, potentially enabling them to inject host-local media references into channel action paths that expect normalized media. Successful exploitation can lead to unauthorized access to sensitive information and disruption of the intended media interactions.

Affected Version(s)

OpenClaw 2026.4.7 < 2026.4.10

OpenClaw 2026.4.10

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/979c6f09d6fad...
patch
https://www.vulncheck.com/advisories/openclaw-sandbox-med...
third-party-advisory

CVSS V4

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Akiyama Mio (@Telecaster2147)
.