Executive brief
OpenClaw is a development tool framework that includes a sandboxed image processing component. A flaw in the image tool allows authenticated users to bypass workspace access restrictions and read sensitive files from outside the intended working directory (such as /agent/*), then exfiltrate that content to external vision model providers. This circumvents security controls that were intended to prevent access to restricted files.
Technical details
The vulnerability is an access control bypass (CWE-284) in the sandboxed image tool. The root cause is that the workspaceOnly security flag was enforced for file and patch operations but was not propagated to the image tool's sandbox path resolution logic. An authenticated attacker with low privileges can supply a mounted path outside the workspace boundary, causing the image tool to load and forward sensitive image bytes to vision model providers without triggering the intended guardrails. The fix threads the workspaceOnly flag into image-tool construction and adds sandbox-root containment validation before loading media. Patch version 2026.2.23 and later are unaffected.
Affected products
- OpenClaw openclaw <= 2026.2.22-2
Timeline
- 2026-03-04: disclosed: Advisory published
- 2026-02-23: patched: Version 2026.2.23 released with fix