CVE-2026-32033: Openclaw

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due to canonicalization mismatch. Attackers can exploit this by crafting @-prefixed paths like @/etc/passwd to read files outside the intended workspace boundary when tools.fs.workspaceOnly is enabled.

Affected products

• Openclaw Openclaw: before 2026.2.24 (fixed in 2026.2.24)

Published 2026-03-19. Last modified 2026-06-17.