EUVD-2026-21462Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Resource sphere isolation
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.5 reflects a moderate-to-high risk with network accessibility, low attack complexity, and requirement for low-level authentication (PR:L). The confidentiality impact is rated high (C:H), but integrity and availability are unaffected (I:N, A:N), limiting the severity to information disclosure. The availability of upstream fixes in the referenced commits indicates the vendor has acknowledged and addressed the issue. Exploitation requires an authenticated user with at least standard-level privileges, reducing immediate risk in air-gapped or tightly controlled environments. The publicly documented commit hashes allow defenders to verify patch application. No active CISA KEV exploitation status or public proof-of-concept was identified in the input data, but the straightforward nature of path traversal attacks and the existence of multiple upstream fixes suggest this is a practical, exploitable vulnerability that should be prioritized for patching in production environments handling sensitive data. |
| Exploit ScenarioDerived | An authenticated user with standard privileges connects to an OpenClaw instance and uses the image tool to process a specially crafted path containing traversal sequences (e.g., ../../../etc/passwd or similar mount-relative escapes) targeting sandbox bridge mounts. The tool fails to validate the path against the workspace boundary restrictions, allowing the attacker to read sensitive files outside the intended workspace such as configuration files, credentials, or other system data that would normally be protected by the sandbox. The low attack complexity and network accessibility make this exploitable by any authenticated user without requiring advanced techniques. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Filesystem boundary bypass in OpenClaw before 2026.3.2 allows authenticated attackers to read arbitrary files by traversing sandbox bridge mounts outside the configured workspace, circumventing the tools.fs.workspaceOnly restriction. The vulnerability affects the image tool specifically and results in unauthorized information disclosure accessible via network with low complexity.
RemediationAI
Upgrade OpenClaw to version 2026.3.2 or later, which incorporates fixes from commits ccfeecb6887cd97937e33a71877ad512741e82b2, 630f1479c44f78484dfa21bb407cbe6f171dac87, dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53, and 14baadda2c456f3cf749f1f97e8678746a34a7f4. These commits address the filesystem boundary validation logic in the image tool. Until patching is possible, review and enforce the principle of least privilege for users with access to the image tool, and restrict network access to OpenClaw instances where feasible. For detailed remediation instructions, consult the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-cfp9-w5v9-3q4h and VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-filesystem-boundary-bypass-in-image-tool.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw's image tool implements a sandbox mechanism intended to restrict filesystem access to designated workspace boundaries via the tools.fs.workspaceOnly configuration. However, the tool fails to properly validate filesystem paths when traversing sandbox bridge mounts, allowing attackers to escape these restrictions. CWE-668 (Exposure of Resource to Wrong Sphere) indicates that protected filesystem resources are exposed outside their intended security boundary. The vulnerability leverages the interaction between the mount abstraction layer and path resolution logic, enabling an authenticated user to read files that other filesystem tools would properly reject based on workspace confinement rules.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.
Blast Radius
ecosystem impact- 4 npm packages depend on openclaw (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in OpenClaw Multiple Authorization and Privilege Escalation
View all 29Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB