OpenClaw CVE-2026-100533

Requires the tools.fs.workspaceOnly filesystem-restriction feature to be in use (the boundary being bypassed) and an attacker who is already an 'admitted requester' with authorized access to OpenClaw's filesystem tools (PR:L). The attacker must additionally craft a Unicode filename whose fallback normalization produces a canonically-equivalent sibling directory that collapses a previously-validated parent path component (AC:H plus AT:P). Limiting factors: no code execution or file modification is possible (read-only confidentiality impact); exploitation is bounded to files readable by the Gateway process outside the workspace; and success depends on discovering a working Unicode-equivalence encoding against the specific normalization logic. Fixed in version 2026.8.1.

This is a moderate-priority, confidentiality-only path traversal. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N, base 6.0) tells a consistent story with the description: network-reachable but high complexity (AC:H) because it depends on crafting canonically-equivalent Unicode filenames that survive the workspaceOnly validation, an attack requirement (AT:P), and low privileges (PR:L) since the attacker must already be an 'admitted requester' with filesystem-tool access. Impact is purely confidentiality (VC:H, VI/VA:N) - arbitrary file READ outside the workspace, no write or execution. Exploitation signals are weak: no EPSS score is provided, the CVE is NOT on CISA KEV, and no public exploit code is referenced - so this is neither confirmed exploited nor known-weaponized. The severity is driven by the high confidentiality impact of escaping a security boundary, not by ease or breadth of exploitation. Realistically this is a targeted, prerequisite-heavy issue in a niche open-source agent framework rather than a broad, opportunistically-exploited flaw. No conflicting signals in the data; the CVSS network vector is consistent with the described remote-requester model, and the PR:L honestly reflects the required admission.

An attacker who is already an admitted requester to an OpenClaw Gateway (i.e., has authorized access to filesystem tools bounded by tools.fs.workspaceOnly) requests a file using a Unicode-encoded path whose fallback normalization collapses to a validated parent directory component. The canonically-equivalent sibling directory resolves outside the configured workspace, letting the agent read host files the operator intended to keep off-limits. No public exploit code is identified at time of analysis, and the high attack complexity means the attacker must know or discover a working Unicode-equivalence encoding.