A critical local file inclusion vulnerability in the OpenClaw BlueBubbles extension allows unauthenticated attackers to exfiltrate sensitive local files, posing a significant risk to system confidentiality.

The vulnerability exists in the sendBlueBubblesMedia function, which fails to validate the mediaPath parameter against an allowlist. This flaw permits unauthenticated attackers to manipulate file paths and access sensitive system files, such as /etc/passwd, by triggering the vulnerable extension.

Successful exploitation of this vulnerability allows unauthorized access to sensitive local files, which may contain configuration data, credentials, or system information. Given the CVSS score of 7.5, this high severity flaw could lead to full system compromise or facilitate further lateral movement within the network. The ability for unauthenticated attackers to perform these actions without user interaction elevates the business risk to a critical level.

Immediate Action: Update the OpenClaw software to version 2026.2.14 or later to apply the necessary input validation fixes.

Proactive Monitoring: Review access logs for suspicious requests directed at the BlueBubbles extension or attempts to access common system files through unusual parameter inputs.

Compensating Controls: If an immediate update is not feasible, disable the BlueBubbles extension entirely to eliminate the attack surface, or deploy a Web Application Firewall rule to block requests containing directory traversal patterns in the mediaPath parameter.

Public Exploit Available: Unknown.

The vulnerability represents a significant risk to data confidentiality due to the lack of access controls on the vulnerable extension. Administrators must prioritize updating to version 2026.2.14 immediately to ensure the input validation patch is applied. If the BlueBubbles extension is not required for business operations, it should be disabled as a standard security precaution to minimize the attack surface.