CVE-2026-53826: Openclaw Information Disclosure Flaw

CVE-2026-53826 Overview

CVE-2026-53826 is an information disclosure vulnerability affecting OpenClaw versions before 2026.4.26. The flaw resides in the sandboxed session spawning logic, which leaks the real host workspace path into child prompts. When a sandboxed parent session spawns a child session, the child model receives workspace location data that should remain isolated from the sandbox boundary. This exposes host filesystem context and related memory context to downstream models. The vulnerability is classified under CWE-668: Exposure of Resource to Wrong Sphere and requires low-privileged network access to exploit.

Critical Impact
Sandboxed sessions leak the real host workspace path to child prompts, undermining isolation guarantees between parent and child model contexts.

Affected Products

OpenClaw (Node.js distribution) versions prior to 2026.4.26
Deployments using sandboxed session spawning features
Multi-agent configurations where parent sessions spawn child sessions

Discovery Timeline

2026-06-12 - CVE-2026-53826 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53826

Vulnerability Analysis

The vulnerability stems from incorrect sphere boundary enforcement during session spawning. OpenClaw uses sandboxed sessions to isolate model execution from host context, including the real workspace path on disk. When a sandboxed parent session spawns a child session, the child prompt construction process incorporates context that originates from outside the sandbox. This context includes the host workspace path and potentially related memory state. The child model then receives information that the sandbox was specifically designed to withhold. An attacker operating within a low-privileged sandboxed context can trigger child session spawning to extract host filesystem locations. This disclosure can support follow-on attacks such as targeted prompt injection, directory enumeration, or reconnaissance of the host environment.

Root Cause

The root cause is a resource exposure to the wrong sphere [CWE-668]. The spawning routine fails to strip or sanitize host workspace context before forwarding it to a child session that runs under inherited sandbox constraints. The sandbox boundary is enforced at the parent level but not propagated correctly to derived sessions.

Attack Vector

An attacker with low-privileged access to a sandboxed OpenClaw session initiates a child session through normal spawning mechanisms. The spawned child receives prompt context that includes the real workspace path. The attacker reads or exfiltrates this disclosed path from the child session. No user interaction is required, and the attack is conducted over the network against the vulnerable component.

Detailed technical analysis of the spawning logic is available in the GitHub Security Advisory GHSA-6c4r-g249-wv3c and the VulnCheck Advisory.

Detection Methods for CVE-2026-53826

Indicators of Compromise

Child session prompts containing absolute host filesystem paths that should not cross the sandbox boundary
Unexpected references to host workspace directories in session logs or model outputs
Sandboxed sessions spawning child sessions at anomalous frequencies

Detection Strategies

Audit OpenClaw session logs for child prompts containing workspace path strings inherited from sandboxed parents
Compare deployed OpenClaw versions against the fixed release 2026.4.26 using software inventory tooling
Inspect prompt construction telemetry for context fields that include host-level path information when the parent is sandboxed

Monitoring Recommendations

Enable verbose session spawn logging and forward events to a centralized log platform for analysis
Alert on child session creation events that include path-like strings matching host workspace locations
Track outbound network calls from child sessions that reference disclosed workspace paths

How to Mitigate CVE-2026-53826

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.26 or later across all environments
Inventory all OpenClaw deployments, including embedded Node.js installations, and verify versions
Review historical session logs for evidence of workspace path disclosure to child sessions

Patch Information

The vendor has released a fix in OpenClaw 2026.4.26. Refer to the GitHub Security Advisory GHSA-6c4r-g249-wv3c for patch details and release notes. Operators should apply the update through their standard Node.js package management workflow.

Workarounds

Disable sandboxed session spawning of child sessions until the patched version is deployed
Restrict network access to OpenClaw endpoints so only trusted, authenticated clients can initiate sessions
Run OpenClaw in workspace directories that do not reveal sensitive host structure if disclosure occurs

bash

# Update OpenClaw to the patched release
npm install openclaw@2026.4.26

# Verify the installed version
npm list openclaw