Executive brief
OpenClaw is an AI automation platform that can execute tasks on users' systems. When workspace-only file restrictions are enabled (an optional security feature), the tool failed to properly validate hardlink aliases, allowing attackers to read or modify files outside the intended workspace boundary through hardlinks created inside the workspace. This could expose sensitive files or enable attackers to inject malicious code.
Technical details
The vulnerability is a link-following bypass (CWE-59, CWE-668) in OpenClaw's workspace boundary validation. When the tools.fs.workspaceOnly or tools.exec.applyPatch.workspaceOnly settings are enabled (non-default), OpenClaw failed to detect hardlink aliases during path safety checks. An attacker with access to the workspace could create hardlinks pointing to files outside the workspace boundary, then use in-workspace hardlink paths to read or write to out-of-workspace files. This bypassed the intended filesystem isolation. The fix, released in version 2026.2.25, now rejects hardlinked final-file aliases during workspace boundary validation for read/write/edit operations and apply_patch checks, including sandbox mount-root path-safety guards. No authentication or user interaction is required beyond the ability to create files in the workspace.
Affected products
- OpenClaw openclaw <= 2026.2.24
Timeline
- 2026-03-04: disclosed
- 2026-02-26: patched: Fix commit 04d91d0319b82fd4de91ed05e9fc5219ff2ab64e on main branch; patch release 2026.2.25