CVE-2026-35658
Openclaw ≤ 2026.3.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-35658 is a medium-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Openclaw Openclaw. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21462
Vulnerability Data
OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Bypass of workspace/sandbox restrictions directly enables unauthorized reading of arbitrary local files outside intended boundaries.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces the tools.fs.workspaceOnly access restriction that the image tool fails to honor, blocking unauthorized file reads via path traversal.
Enforces information flow rules between the sandbox and external mounts, preventing the boundary bypass that allows reads outside the workspace.
Implements boundary protection mechanisms around sandbox bridge mounts to stop traversal attacks that circumvent workspaceOnly limits.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege authorizations directly prevents resources from being exposed outside their intended control sphere.
Network segmentation and unauthorized-access protections reduce the chance of resources being reachable by the wrong sphere.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.
Requiring owners to manage the full asset life cycle and remove assets from the inventory upon secure disposal helps prevent resources from being inadvertently exposed outside their intended security sphere.