CVE-2026-100533: OpenClaw Path Traversal Vulnerability

CVE-2026-100533 Overview

CVE-2026-100533 is a path traversal vulnerability [CWE-22] in OpenClaw versions prior to 2026.8.1. The flaw resides in the tools.fs.workspaceOnly feature, where a Unicode filename fallback normalizes validated parent directory components. Authenticated requesters can leverage canonically equivalent sibling directories to read files outside the configured workspace boundary.

The vulnerability allows information disclosure of files that should remain inaccessible to the requester. Exploitation requires low-privilege access and succeeds without user interaction, though attack complexity is elevated because the attacker must craft Unicode sequences that survive the initial validation and resolve to a traversal target after normalization.

Critical Impact
Admitted requesters can read arbitrary files outside the configured OpenClaw workspace boundary by abusing Unicode normalization in the filesystem tool.

Affected Products

OpenClaw versions before 2026.8.1
Deployments using the tools.fs.workspaceOnly feature
Any OpenClaw instance exposed to authenticated remote requesters

Discovery Timeline

2026-09-26 - CVE-2026-100533 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100533

Vulnerability Analysis

OpenClaw's tools.fs.workspaceOnly feature enforces a workspace boundary by validating that requested path components stay within the configured directory. The validation runs against the raw input before a secondary Unicode normalization pass rewrites filename bytes.

That ordering is the defect. Normalization occurs after validation, so canonically equivalent characters pass the initial check and then collapse into traversal-relevant components such as parent-directory references or sibling directory names. The result is a confused deputy: the tool believes the request stays inside the workspace while the resolved filesystem path escapes it.

Root Cause

The root cause is a time-of-check to time-of-use mismatch between path validation and Unicode normalization. OpenClaw validates the pre-normalization form of the path, then normalizes the filename as a fallback when the direct lookup fails. Characters that are visually or semantically distinct before normalization can resolve to canonically equivalent sibling or parent directory components afterward, defeating the workspace boundary check.

Attack Vector

An authenticated requester with permission to invoke the filesystem tool submits a path containing Unicode sequences that normalize into traversal components. The initial validation accepts the input because the pre-normalization form does not contain disallowed segments. The fallback normalization then rewrites the filename into a canonical form that references a sibling directory outside the workspace, and OpenClaw returns the file contents.

The vulnerability is network-reachable and requires low privileges. No user interaction is needed. Impact is limited to confidentiality; integrity and availability of the target system are not affected directly. Technical details are documented in the GitHub Security Advisory GHSA-5rx7-34fw-64qg and the VulnCheck Advisory.

Detection Methods for CVE-2026-100533

Indicators of Compromise

Filesystem tool requests containing non-ASCII Unicode characters in path components, particularly characters known to normalize into ., /, or \ equivalents.
Successful file reads where the resolved path lies outside the configured workspace directory.
Repeated workspace tool invocations from a single authenticated principal targeting sibling directories.

Detection Strategies

Log every tools.fs.workspaceOnly invocation with both the pre-normalization input and the final resolved filesystem path, then alert when the two diverge in parent-directory depth.
Deploy signatures that flag Unicode codepoints in path parameters that are known to normalize into separator or dot sequences under NFC or NFKC.
Correlate authenticated session activity against expected workspace scope to surface anomalous read patterns.

Monitoring Recommendations

Centralize OpenClaw application logs in a SIEM and alert on resolved paths that contain .. segments or escape the configured workspace root.
Baseline normal filesystem tool usage per account and alert on sudden expansion of accessed directories.
Monitor outbound data volume from accounts invoking the filesystem tool to detect bulk extraction attempts.

How to Mitigate CVE-2026-100533

Immediate Actions Required

Upgrade OpenClaw to version 2026.8.1 or later across all deployments.
Audit authenticated principals with access to the tools.fs.workspaceOnly feature and revoke access that is not operationally required.
Review access logs for unexpected file reads from workspace tool invocations since the vulnerable version was deployed.

Patch Information

Upgrade to OpenClaw 2026.8.1 or later. The fix is tracked in the GitHub Security Advisory GHSA-5rx7-34fw-64qg. The patched release reorders validation so that Unicode normalization occurs before the workspace boundary check, ensuring the canonical form of the path is what the enforcement logic evaluates.

Workarounds

Disable the tools.fs.workspaceOnly feature until the upgrade is applied if operational requirements permit.
Restrict the authenticated principal set that can invoke filesystem tools to a minimal, trusted group.
Place the OpenClaw workspace on a dedicated filesystem mount with no sensitive sibling directories reachable from the parent path.

bash

# Verify installed OpenClaw version and upgrade
openclaw --version
pip install --upgrade "openclaw>=2026.8.1"