OpenClaw before 2026.3.2 contains a filesystem boundary bypass in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject. The vulnerability enables reading of sensitive files beyond the intended workspace area, potentially exposing configuration details, secrets, or other confidential data. The flaw is classified as CWE-668, reflecting an improper restriction or validation of user-supplied data.

The affected product is OpenClaw. All installations running OpenClaw earlier than 2026.3.2 are vulnerable. The software is a Node.js based tool, and the repository commits confirm the issue. No additional vendor variants are listed.

The CVSS score is 6.0, indicating medium severity. EPSS information is not available, so we cannot quantify exploitation likelihood from the available data. The vulnerability is not listed in CISA’s KEV catalog, implying no known exploits. Attackers would need to trigger the image tool with a crafted request that traverses the sandbox boundary, which likely requires either local access or a user-controlled image upload. The impact is limited to file read; there is no known code execution path, but unauthorized access could aid a broader compromise.