Missing Authorization in OpenClaw - CVE-2026-100526
Published: November 3, 2026
Vulnerability identifier: #VU158790
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100526
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose local file contents outside the sender's configured media roots through outbound Discord emoji or sticker uploads.
The vulnerability exists due to missing authorization in OpenClaw's Discord emoji and sticker upload actions when loading local files without retaining the sender-scoped media policy. A remote user can invoke an allowed guild asset action with a known or derived local file path to upload file contents that the sender's configured media roots would otherwise reject.
The issue does not provide unrestricted filesystem browsing or code execution.
Affected software
OpenClaw
How to mitigate CVE-2026-100526
Install security update from vendor's website.
OpenClaw - update to 2026.9.3