Openclaw cli: OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images (CVE-2026-32002)
Description
OpenClaw CLI's sandboxed image tool bypasses the workspace-only file access restriction, allowing it to read and exfiltrate mounted images outside the designated workspace. This vulnerability affects versions prior to 2026.2.23 and was fixed by enforcing workspace-only constraints on the image tool's path resolution. The issue results in a sandbox boundary bypass with confidentiality impact but does not affect integrity or availability.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In OpenClaw CLI, the sandboxed 'image' tool failed to enforce the 'tools.fs.workspaceOnly=true' restriction for mounted paths resolved via the sandbox filesystem bridge. While other file operations like read, write, and edit respected workspace-only guardrails, the image tool could load and exfiltrate files mounted outside the workspace (e.g., '/agent/*') by forwarding their bytes to vision model providers. The vulnerability was fixed in version 2026.2.23 by propagating the workspaceOnly flag into the image tool construction and asserting sandbox-root containment before loading media bytes.
Potential Impact
This vulnerability allows a sandbox boundary bypass that compromises confidentiality by enabling the image tool to read and exfiltrate files outside the intended workspace. There is no impact on integrity or availability. The confidentiality breach could expose sensitive mounted images to external vision model providers.
Mitigation Recommendations
A patch is available and should be applied by upgrading to OpenClaw CLI version 2026.2.23 or later. The fix ensures that the workspace-only restriction is enforced for the image tool, preventing out-of-workspace file access and exfiltration.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32002
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245c112601ec6a3166c54
Added to database: 10/04/2026, 12:25:37 UTC
Last enriched: 10/04/2026, 13:06:13 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.