CVE-2026-100547 OpenClaw CVE debrief

Who should care

Defenders responsible for OpenClaw deployments should assess exposure and verify versions in use. System administrators and security teams should prioritize updating OpenClaw to a non-vulnerable version and restricting access to the Agent Client Protocol (ACP).

Why it matters

CVE-2026-100547 is a vulnerability in OpenClaw that allows an untrusted or compromised ACP peer to request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. Defenders should prioritize verifying OpenClaw versions, restricting ACP access, and monitoring for suspicious activity.

• File confidentiality disclosure
• Verification of OpenClaw versions and ACP peer trust
• Monitoring for suspicious file read activity

Technical summary

The vulnerability is caused by the incorrect classification of alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) as relative paths scoped to the session working directory. This allows an untrusted or compromised ACP peer to request a read of a file outside the session working directory without the approval prompt normally required for that path, potentially resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. Defenders should prioritize verifying OpenClaw versions, restricting ACP access, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying the versions of OpenClaw in use and ensuring that they are updated to a version that is not vulnerable.

Recommended defensive actions

• Verify OpenClaw versions in use and update to a non-vulnerable version
• Restrict access to the Agent Client Protocol (ACP) to trusted peers
• Monitor for suspicious activity related to file reads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide information about the vulnerability and its impact. However, the corpus does not establish versions, exploitation, impact, or remediation beyond what is provided, and those points require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.