Executive brief
OpenClaw, an AI-driven workspace and session management tool, contains a flaw where sensitive system path information can be leaked. When a new session is created from within a restricted 'sandboxed' environment, the system accidentally reveals the actual file path of the host workspace to the underlying AI model. This could allow an attacker to discover the internal directory structure of the server or access sensitive memory context that should have remained hidden.
Technical details
An information disclosure vulnerability exists in OpenClaw versions prior to 2026.4.26 due to improper resource isolation (CWE-668) during session spawning. When a child session is initiated from a sandboxed parent session, the application fails to mask the host's real workspace path, forwarding it into the child session's prompt context. An authenticated attacker with low privileges can exploit this over the network to reveal the host's physical directory structure or related memory context to the child AI models. The issue is resolved in version 2026.4.26; users are advised to avoid spawning child sessions from sensitive sandboxed workspaces until they have updated.
Affected products
- OpenClaw OpenClaw < 2026.4.26
Timeline
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: NVD publication date