An incorrect authorization flaw in OpenClaw versions 2026.4.9 before 2026.4.10 allows authenticated attackers to bypass sender policy restrictions and retrieve arbitrary local files.

This is an incorrect authorization vulnerability, classified under CWE-863, affecting the outbound host-media attachment read helper with low privileges required and network attack vector.

A successful exploit allows unauthorized access to sensitive local files, potentially exposing internal system configurations or confidential data. With a CVSS score of 7.7, this high severity vulnerability threatens organizational confidentiality and demands prompt remediation to prevent data exfiltration.

Immediate Action: Update the OpenClaw package to version 2026.4.10 or later.

Proactive Monitoring: Review access logs and monitor for anomalous file read requests originating from the outbound media path.

Compensating Controls: Restrict network access to the affected service and enforce strict principle of least privilege regarding file system permissions.

Public Exploit Available: No

Given the high severity rating and potential for local file disclosure, security teams should treat this advisory with urgency. Apply the official vendor update to version 2026.4.10 immediately to eliminate the authorization bypass vector and secure sensitive file assets.