CVE-2026-43532: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-43532 is a sandbox media normalization bypass vulnerability in OpenClaw (npm package) affecting versions 2026.4.7 through 2026.4.10 (exclusive). The flaw allows authenticated, low-privileged attackers to inject host-local media references into channel action paths by bypassing the sandbox media normalization applied to Discord event cover image parameters. It was published on May 5, 2026, with a patch available in version 2026.4.10. The vulnerability carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory, Feedly).

The root cause is an incomplete list of disallowed or normalized inputs (CWE-184): the SANDBOX_MEDIA_PARAM_KEYS constant in src/infra/outbound/message-action-params.ts omitted the image parameter, meaning Discord eventCreate.image values were never subjected to sandbox path rewriting. An authenticated attacker can supply a crafted image parameter (e.g., file:///workspace/assets/sensitive-file) when creating a Discord event; because the value bypasses normalization, it is passed as-is to a channel action path that expects a normalized, sandboxed media reference, allowing the host-local path to be resolved. The fix, introduced in PR #64377 and commit 979c6f09, adds "image" to the SANDBOX_MEDIA_PARAM_KEYS array and adds corresponding test coverage (GitHub Commit, GitHub Advisory).

Successful exploitation enables an authenticated, low-privileged user to read arbitrary host-local files accessible to the OpenClaw process by injecting file:// URIs as Discord event cover image parameters, resulting in unauthorized file and data disclosure. The scope is changed (CVSS S:C), meaning the impact extends beyond the vulnerable component itself into the broader sandbox environment. Confidentiality is the primary concern; integrity and availability are not directly affected by this vulnerability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.037%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid, low-privileged authenticated session, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Authentication: Obtain a low-privileged authenticated session on an OpenClaw instance running versions 2026.4.7 through 2026.4.9.
2. Identify the vulnerable endpoint: Locate the Discord event creation functionality (e.g., the eventCreate action path) within the OpenClaw interface or API.
3. Craft a malicious image parameter: Prepare a request that sets the image parameter to a host-local file:// URI pointing to a sensitive file, such as file:///etc/passwd or file:///workspace/secrets/config.json.
4. Submit the request: Send the crafted Discord event creation request. Because the image key is absent from SANDBOX_MEDIA_PARAM_KEYS, the value bypasses sandbox media normalization.
5. Retrieve disclosed content: The host-local file reference is passed to the channel action path expecting normalized media, potentially causing the server to read and return the contents of the targeted file to the attacker (GitHub Advisory, GitHub Commit).

• Network: Unusual API requests to Discord event creation endpoints containing image parameter values with file:// URI schemes (e.g., file:///etc/, file:///workspace/) from authenticated low-privileged accounts.
• Logs: Application logs showing eventCreate or channel action path invocations where the image field contains an absolute local file path rather than a normalized or remote URL; repeated requests with varying file:// paths from the same account may indicate enumeration.
• File System: No direct file system artifacts are expected from exploitation, but access logs for sensitive files (e.g., /etc/passwd, configuration files) may show reads by the OpenClaw process at unusual times.
• Process: The OpenClaw Node.js process reading files outside its expected working directory or sandbox root, observable via OS-level file access auditing (e.g., auditd on Linux) (GitHub Advisory).

Upgrade OpenClaw to version 2026.4.10 or later (the latest npm release, openclaw@2026.4.14, also includes the fix). The patch adds "image" to the SANDBOX_MEDIA_PARAM_KEYS list, ensuring Discord event cover image parameters are subject to sandbox path rewriting. If immediate patching is not possible, restrict authenticated user access to Discord event creation functionality via network access controls, and monitor audit logs for suspicious file:// URI submissions in image parameters (GitHub Advisory, GitHub Commit).

The vulnerability was reported by @zsxsoft with sponsorship from @KeenSecurityLab and @qclawer, and was acknowledged and fixed by the OpenClaw maintainers in PR #64377. The advisory was published at a "Moderate" severity level by the OpenClaw project. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability aggregator postings (GitHub Advisory).