Executive brief
OpenClaw, a tool used for managing AI gateway sessions and plugins, contains a vulnerability where sandboxed environments may leak sensitive host information. Specifically, when a new session is started from within a protected workspace, the actual file path of the host system can be exposed to the AI model. This could allow an attacker or a low-trust AI prompt to discover the internal directory structure or memory context of the server, potentially aiding in further targeted attacks.
Technical details
A vulnerability classified as 'Exposure of Resource to Wrong Sphere' (CWE-668) exists in OpenClaw versions up to 2026.4.25. When a child session is spawned from a sandboxed parent session, the host's real workspace path may be forwarded into the child session's prompt context. An authenticated attacker with low privileges can exploit this over the network to leak host workspace locations or related memory context. The impact is limited to confidentiality, as it does not allow for unauthorized modification or service disruption. The issue is resolved in version 2026.4.26.
Affected products
- openclaw openclaw <= 2026.4.25
Timeline
- 2026-05-28: disclosed: Initial disclosure by researcher
- 2026-07-02: advisory: GitHub Advisory published
- 2026-04-26: patched: First stable patched version released