Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.0
OpenClaw Image Tool Fails to Enforce Workspace File System Boundary
published 6 months ago
Summary
OpenClaw's image tool could accidentally access files outside its workspace, potentially exposing sensitive data. This happens because the tool didn't properly follow the rules set by the workspace file system. To fix this, update OpenClaw to version 2026.3.2 or later.
What to do
- Update steipete openclaw to version 2026.3.2.
- Update GitHub Actions openclaw to version 2026.3.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | steipete | openclaw |
< 2026.3.2 Fix: upgrade to 2026.3.2
|
| npm | GitHub Actions | openclaw |
< 2026.3.2 Fix: upgrade to 2026.3.2
|
Original advisory text
OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts ...
OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cfp9-w5v9-3q4h URL
- https://github.com/openclaw/openclaw/commit/14baadda2c456f3cf749f1f97e8678746a34... URL
- https://github.com/openclaw/openclaw/commit/dd9d9c1c609dcb4579f9e57bd7b5c879d014... URL
- https://github.com/openclaw/openclaw Product
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171d... URL
- https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e... URL
- https://www.vulncheck.com/advisories/openclaw-filesystem-boundary-bypass-in-imag... URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-35658 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
6.0
Medium
Type
CWE-863Incorrect Authorization
CWE-668Exposure of Resource to Wrong Sphere
Timeline
Published10 Apr 2026
Updated10 Apr 2026
First seen26 Mar 2026
Sources
GHSA-cfp9-w5v9-3q4h · OSV
Track software like this
Free during beta