CVE-2026-26321: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26321 is a path traversal (local file disclosure) vulnerability in OpenClaw, a personal AI assistant, affecting its Feishu extension. Prior to version 2026.2.14, the sendMediaFeishu function improperly treated attacker-controlled mediaUrl parameter values as local filesystem paths, enabling direct reads of arbitrary files on the host system. The vulnerability was published on February 15, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OpenClaw Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable code in extensions/feishu/src/media.ts contained an isLocalPath() helper that detected whether mediaUrl started with /, ~, or a Windows drive letter, and if so, read the file directly from the filesystem using fs.readFileSync() without enforcing any directory restrictions. An attacker who can influence tool calls — either directly or via prompt injection into the AI assistant — can supply a value such as /etc/passwd as mediaUrl, causing the application to read and return the file's contents. No authentication or user interaction is required for exploitation (GitHub Advisory, Fix Commit).

Successful exploitation results in unauthorized disclosure of arbitrary local files readable by the OpenClaw process, with high confidentiality impact and no integrity or availability impact. Sensitive targets include system files (e.g., /etc/passwd), application configuration files, private keys, credentials, and environment files. Because no authentication is required and the attack vector is network-accessible, the exposure surface is broad for any internet-facing OpenClaw deployment with the Feishu extension enabled (GitHub Advisory, OpenClaw Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.028% (9th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no privileges or user interaction, lowering the practical barrier for exploitation if an attacker can influence tool calls or inject prompts into the AI assistant.

1. Identify target: Locate an internet-accessible OpenClaw instance (version < 2026.2.14) with the Feishu extension configured and active.
2. Gain influence over tool calls: Exploit a prompt injection vector — for example, by crafting a malicious message or document that the AI assistant processes — to influence the parameters passed to the sendMediaFeishu tool call.
3. Supply a malicious mediaUrl: Provide a local filesystem path (e.g., /etc/passwd, ~/.ssh/id_rsa, or /proc/self/environ) as the mediaUrl parameter value instead of a legitimate remote URL.
4. Trigger file read: The vulnerable sendMediaFeishu function detects the path as local via isLocalPath() and calls fs.readFileSync() on the supplied path, reading the file contents into a buffer.
5. Exfiltrate data: The file contents are processed and sent as media through the Feishu channel, delivering the sensitive file data to the attacker-controlled destination (GitHub Advisory, Fix Commit).

• Logs: OpenClaw application logs showing sendMediaFeishu invocations with mediaUrl values that begin with /, ~, or a Windows drive letter (e.g., C:\) rather than http:// or https://; log entries referencing file paths such as /etc/passwd, /etc/shadow, ~/.ssh/id_rsa, or /proc/self/environ.
• File System: Unexpected access timestamps on sensitive system files (e.g., /etc/passwd, /etc/shadow, SSH key files) coinciding with OpenClaw process activity.
• Network: Outbound Feishu API calls (open.feishu.cn or open.larksuite.com) containing file content in media upload payloads; unusual volume or frequency of media upload requests from the OpenClaw host.
• Process: Node.js process (OpenClaw) performing fs.readFileSync calls on paths outside expected application directories, observable via system call tracing (e.g., strace, auditd file access events).

The primary remediation is to upgrade OpenClaw to version 2026.2.14 or later, which removes direct local file reads from sendMediaFeishu and routes all media loading through hardened helpers that enforce local-root restrictions (OpenClaw Release, Fix Commit). For deployments that cannot be immediately patched, implement network-level controls to restrict the Feishu extension's outbound access and limit who can submit prompts or influence tool calls. Additionally, audit OpenClaw logs for suspicious mediaUrl values referencing local filesystem paths as a detection measure (GitHub Advisory).

The vulnerability was reported by researcher zpbrent and the fix was contributed by @mbelinky, as credited in the GitHub advisory and release notes (OpenClaw Advisory, OpenClaw Release). Brief mentions appeared on Mastodon and Bluesky via The Hacker Wire shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the advisory has been identified.