Openclaw cli: OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default) (CVE-2026-32007)

In OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.23, the experimental apply_patch tool did not consistently enforce workspace-only restrictions on mounted paths within opt-in sandbox configurations. Specifically, apply_patch used sandbox.bridge.resolvePath without applying the workspace-root assertion that other filesystem tools enforce, allowing operations on writable mounts outside the workspace root. This behavior requires sandbox mode enabled, the experimental apply_patch tool enabled, workspace-only expectations set, and writable mounts outside the workspace. The issue was resolved by a code fix committed on main (commit 6634030be31e1a1842967df046c2f2e47490e6bf) and released in version 2026.2.23.

The vulnerability allows apply_patch operations to target mounted paths outside the intended workspace root under specific sandbox configurations. This could lead to unauthorized modification of files outside the workspace boundaries. However, default OpenClaw CLI installations are not affected because sandbox mode and the experimental apply_patch tool are disabled by default.

A patch is available and was released in OpenClaw CLI version 2026.2.23. Users should upgrade to version 2026.2.23 or later to remediate this issue. If the experimental apply_patch tool or sandbox mode is not enabled, no action is required.