Openclaw cli: OpenClaw's avatar symlink traversal can expose out-of-workspace local files (CVE-2026-32024)

OpenClaw CLI's avatar handling in versions <= 2026.2.21 and prereleases 2026.2.21-1 and 2026.2.21-2 allows symlink traversal that can expose local files outside the configured workspace boundary. The vulnerability arises because local avatar resolution could follow symlinks and return file bytes from outside the workspace. The fix hardens the gateway avatar metadata resolution by enforcing canonical containment, O_NOFOLLOW flags, and file descriptor/file-identity checks. Additionally, the control UI avatar serving rejects symlink paths and enforces file descriptor, identity, and size checks before reading files. The patch is scheduled for release in version 2026.2.22.

The vulnerability impacts confidentiality by allowing an attacker with local privileges to read arbitrary local files accessible to the OpenClaw process outside the intended workspace. There is no impact on integrity or availability. No known exploits are reported in the wild.

A patch is available and planned for release in OpenClaw CLI version 2026.2.22. Users should upgrade to version 2026.2.22 or later once released to remediate this vulnerability. Until then, avoid running untrusted code or avatars that could exploit symlink traversal. The vendor has implemented strict symlink and file identity checks to prevent this issue.