Security Advisory

CVE-2026-42438

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-05 11:24:56

Last updated 2026-05-05 14:48:23

Assigner VulnCheck

CVSS score 4.9

State PUBLISHED

Description

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file disclosure. Attackers with denied read access via toolsBySender or group policy can trigger host-media attachment loading to bypass sender and group-scoped authorization boundaries and retrieve readable local files through the outbound media path.

← Browse all CVEs View on cve.org ↗