CVE-2026-42438: OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure

OpenClaw’s outbound host-media attachment read helper could enable host-local file reads based on global or agent-level read access without also honoring sender and group-scoped tool policy. In channel deployments that used toolsBySender or group policy to deny read for less-trusted senders, a denied sender could still trigger host-media attachment loading and cause readable local files to be returned through the outbound media path.