OpenClaw versions earlier than 2026.2.23 are vulnerable to a sandbox boundary bypass in the image tool because the tools.fs.workspaceOnly restriction is not enforced on mounted sandbox paths. This flaw allows an attacker to read files outside the intended workspace and exfiltrate them through vision model provider requests, thereby exposing confidential data. The vulnerability is classified as CWE-200, indicating an information exposure weakness.

Affected products are OpenClaw:OpenClaw running on Node.js environments, with all releases prior to 2026.2.23 impacted. No more specific version details are provided beyond the version upper bound.

The CVSS score of 6 indicates medium severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is remote, using the image tool API to load restricted images and trigger external vision model requests that carry the exfiltrated data. Exploitation requires access to the OpenClaw application or its API endpoints, and succeeds because sandbox boundaries are not properly enforced.