CVE-2026-35658: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35658 is a filesystem boundary bypass vulnerability in OpenClaw's image tool that fails to honor the tools.fs.workspaceOnly restriction, allowing authenticated attackers to read files outside the intended workspace sandbox. It affects all OpenClaw (npm) versions before 2026.3.2. The vulnerability was disclosed on April 10, 2026, with the security advisory originally published by maintainer steipete on March 24, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, VulnCheck).

The root cause is an incorrect authorization check (CWE-863 per the GitHub advisory; also classified as CWE-668 Exposure of Resource to Wrong Sphere and estimated as CWE-22 Path Traversal). The createImageTool function in src/agents/tools/image-tool.ts was not passed the fsPolicy/workspaceOnly flag, so image-path resolution via sandbox bridge mounts could traverse outside the workspace directory — a restriction that other filesystem tools (read, write, edit) already enforced. An authenticated, low-privileged attacker can supply an image path such as /agent/secret.png that resolves through the sandbox bridge to a host path outside the workspace, and the image tool would load and transmit those file bytes to a vision provider without triggering the assertSandboxPath guard (GitHub Advisory, Fix Commit dd9d9c1, Fix Commit 14baadd).

Successful exploitation allows an authenticated attacker with low privileges to read arbitrary files accessible via sandbox bridge mounts outside the designated workspace, including potentially sensitive configuration files, credentials, or private data stored on the host. The confidentiality impact is rated High, while integrity and availability are unaffected. Because file contents are forwarded to a configured vision/image model provider, sensitive data could be exfiltrated to an external AI service (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.035% (0.000350), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid (low-privileged) account on the OpenClaw instance and network access, but no user interaction and low attack complexity (Feedly, VulnCheck).

1. Reconnaissance: Identify an OpenClaw instance running a version prior to 2026.3.2 (npm package openclaw) with tools.fs.workspaceOnly enabled and sandbox mode active, accessible over the network.
2. Authenticate: Obtain low-privileged credentials for the OpenClaw instance (e.g., a standard user account).
3. Craft malicious image path: Construct an agent request that invokes the image tool with a path that resolves through the sandbox bridge to a file outside the workspace, such as /agent/secret.png (which maps via the bridge to a host path like ~/.openclaw/agents/secret.png or another sensitive location).
4. Submit request: Send the crafted agent turn to the OpenClaw gateway over the network, triggering resolveSandboxedImagePath in image-tool.ts without the workspaceOnly guard.
5. Exfiltrate data: The image tool loads the out-of-workspace file and transmits its bytes to the configured vision model provider, effectively exfiltrating the file contents to an external service or returning analysis results to the attacker (GitHub Advisory, Fix Commit dd9d9c1).

• Logs: OpenClaw agent logs showing image tool invocations with paths referencing /agent/ or absolute paths outside the configured workspace directory; unexpected outbound requests to vision model API endpoints (e.g., MiniMax, OpenAI vision) carrying image payloads not originating from workspace files.
• File System: Access timestamps updated on sensitive files (e.g., ~/.openclaw/agents/*, credential files) coinciding with agent image tool activity.
• Network: Outbound HTTPS traffic from the OpenClaw process to vision provider endpoints (e.g., api.minimax.chat, api.openai.com) with unusually large or unexpected image payloads during periods of low legitimate usage.
• Process: OpenClaw Node.js process reading files outside the workspace directory as observed via auditd, inotifywait, or equivalent file access monitoring tools.

Upgrade OpenClaw (npm) to version 2026.3.2 or later (latest confirmed fixed versions: v2026.3.23 and v2026.3.23-2), which enforces tools.fs.workspaceOnly in the image and PDF tools via commits dd9d9c1 and 14baadd. As an interim measure, restrict network access to OpenClaw instances to trusted users only, and apply least-privilege access controls to minimize the number of accounts that can invoke agent tools. Monitor file access logs for suspicious read patterns from the image tool component (GitHub Advisory, Fix Commit dd9d9c1, Fix Commit 14baadd).

The vulnerability was reported by researcher YLChen-007 (credited in the GitHub advisory) and fixed by the OpenClaw maintainer steipete. The advisory was rated Moderate severity by the project. No significant broader media coverage or notable community commentary beyond the GitHub advisory and VulnCheck advisory has been observed (GitHub Advisory, VulnCheck).