AI agent vulnerability · OpenClaw

CVE-2026-32033: OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

mediumCVSS 4.0 5.7 · 3.1 7.5GHSA-27cr-4p5m-74rj

A workspace-only file-system guard mismatch allowed @-prefixed absolute paths to bypass boundary validation in some tool path checks. Impact When tools.fs.workspaceOnly=true, certain @-prefixed absolute paths (for example @/etc/passwd) could be validated before canonicalization while runtime path handling normalized the prefix differently.

Published Mar 3, 2026 · Updated Mar 25, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.2.23
Fixed in: 2026.2.24
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A workspace-only file-system guard mismatch allowed @-prefixed absolute paths to bypass boundary validation in some tool path checks.

Impact

When tools.fs.workspaceOnly=true, certain @-prefixed absolute paths (for example @/etc/passwd) could be validated before canonicalization while runtime path handling normalized the prefix differently. In affected code paths this could permit reads outside the intended workspace boundary.

Per SECURITY.md, OpenClaw is primarily a personal-assistant runtime with trusted-user assumptions, and this path is gated behind non-default sandbox/tooling configuration. That reduces practical exposure, but the bypass is still a security bug and is fixed.

Affected Packages / Versions

Package: openclaw (npm)
Latest published at triage time: 2026.2.23
Affected versions: <= 2026.2.23
Patched versions: >= 2026.2.24

Fix Commit(s)

9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260

OpenClaw thanks @tdjackey for reporting.

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries