CVE-2026-31990: OpenClaw symlink traversal enables

CISO Take

OpenClaw, an AI agent framework, contains a path-traversal flaw in its stageSandboxMedia function that fails to validate symlinks before following them during media staging, allowing a low-privileged local user to overwrite arbitrary host files by planting symlinks in the media/inbound directory. Although rated CVSS 6.1 (medium), this CVE sits in the top 3% of all CVEs by EPSS exploitation likelihood, and its trivial exploitation profile—local access, low privileges, no user interaction, low complexity—makes it a realistic threat in shared or multi-tenant AI agent environments. In agentic deployments, overwriting configuration files, SSH keys, or agent tool definitions can directly enable persistent backdoors or escalation to full host compromise, multiplying the blast radius well beyond what the moderate severity label suggests. Organizations should upgrade OpenClaw to 2026.3.2 immediately; as an interim control, restrict write permissions on the media/inbound staging directory and alert on symlink creation within sandbox paths.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 6.1 materially underestimates operational risk in AI agent contexts. CWE-59 (Improper Link Resolution) requires no exploitation complexity beyond local access, placing this within reach of malicious insiders, compromised CI/CD workers, or any process sharing the filesystem with OpenClaw. The EPSS 97th percentile signals that this vulnerability class sees active exploitation at a higher rate than 97% of all disclosed CVEs—despite the low absolute score, the relative signal is strong. The ai_agent classification means OpenClaw likely runs with permissions sufficient to modify agent configurations, model artifacts, or runtime credentials, all high-value targets. The 396 other CVEs in the same package indicate systemic security debt and a historically targeted component.

How does the attack unfold?

Local Access

Attacker with low-privileged local access to a host running OpenClaw confirms write access to the media/inbound staging directory, requiring no special credentials beyond a standard user account.

Symlink Placement

Attacker plants a crafted symlink in media/inbound pointing to a high-value host file outside the sandbox (e.g., ~/.ssh/authorized_keys, a cron entry, or an agent tool definition).

AML.T0079

Sandbox Escape

OpenClaw's stageSandboxMedia processes the staged media queue, follows the unvalidated symlink, and writes attacker-controlled content to the target path on the host filesystem.

AML.T0105

Host Compromise

Overwritten file grants persistence or privilege escalation—an injected SSH key enables interactive shell access; a poisoned agent tool definition triggers code execution on the next agent invocation.

AML.T0112.000

Local Access

Attacker with low-privileged local access to a host running OpenClaw confirms write access to the media/inbound staging directory, requiring no special credentials beyond a standard user account.

Symlink Placement

Attacker plants a crafted symlink in media/inbound pointing to a high-value host file outside the sandbox (e.g., ~/.ssh/authorized_keys, a cron entry, or an agent tool definition).

AML.T0079

Sandbox Escape

OpenClaw's stageSandboxMedia processes the staged media queue, follows the unvalidated symlink, and writes attacker-controlled content to the target path on the host filesystem.

AML.T0105

Host Compromise

Overwritten file grants persistence or privilege escalation—an injected SSH key enables interactive shell access; a poisoned agent tool definition triggers code execution on the next agent invocation.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.3.2 or later (commit 17ede52 resolves the symlink validation gap).
Workaround: Restrict write permissions on media/inbound to the OpenClaw service account only; consider mounting it as a separate filesystem namespace with no-follow-symlinks enforcement (e.g., bind mount with MS_NOSYMFOLLOW on Linux).
Detection: Audit staging directories with 'find /path/to/media/inbound -type l' and deploy inotifywait or auditd rules to alert on symlink creation under sandbox paths.
Containment: Run OpenClaw within a container with seccomp or AppArmor profiles that deny symlink following outside the sandbox workspace boundary.
Verify patch: After upgrade, confirm stageSandboxMedia rejects symlinks pointing outside the workspace by testing with a controlled symlink in a non-production environment.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent AML.T0081 - Modify AI Agent Configuration AML.T0105 - Escape to Host AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.5 - Information security in AI system development and operation

NIST AI RMF

GOVERN-6.1 - Policies and procedures for AI system security

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-31990?

OpenClaw, an AI agent framework, contains a path-traversal flaw in its stageSandboxMedia function that fails to validate symlinks before following them during media staging, allowing a low-privileged local user to overwrite arbitrary host files by planting symlinks in the media/inbound directory. Although rated CVSS 6.1 (medium), this CVE sits in the top 3% of all CVEs by EPSS exploitation likelihood, and its trivial exploitation profile—local access, low privileges, no user interaction, low complexity—makes it a realistic threat in shared or multi-tenant AI agent environments. In agentic deployments, overwriting configuration files, SSH keys, or agent tool definitions can directly enable persistent backdoors or escalation to full host compromise, multiplying the blast radius well beyond what the moderate severity label suggests. Organizations should upgrade OpenClaw to 2026.3.2 immediately; as an interim control, restrict write permissions on the media/inbound staging directory and alert on symlink creation within sandbox paths.

Is CVE-2026-31990 actively exploited?

No confirmed active exploitation of CVE-2026-31990 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31990?

1. Patch: Upgrade OpenClaw to version 2026.3.2 or later (commit 17ede52 resolves the symlink validation gap). 2. Workaround: Restrict write permissions on media/inbound to the OpenClaw service account only; consider mounting it as a separate filesystem namespace with no-follow-symlinks enforcement (e.g., bind mount with MS_NOSYMFOLLOW on Linux). 3. Detection: Audit staging directories with 'find /path/to/media/inbound -type l' and deploy inotifywait or auditd rules to alert on symlink creation under sandbox paths. 4. Containment: Run OpenClaw within a container with seccomp or AppArmor profiles that deny symlink following outside the sandbox workspace boundary. 5. Verify patch: After upgrade, confirm stageSandboxMedia rejects symlinks pointing outside the workspace by testing with a controlled symlink in a non-production environment.

What systems are affected by CVE-2026-31990?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent deployments, multi-tenant AI pipelines.

What is the CVSS score for CVE-2026-31990?

CVE-2026-31990 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent deploymentsmulti-tenant AI pipelines

MITRE ATLAS Techniques

AML.T0081 Modify AI Agent Configuration

AML.T0105 Escape to Host

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.5

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

Exploitation Scenario

A low-privileged attacker with local filesystem access—such as a compromised data pipeline worker co-located with the OpenClaw agent—creates a symlink at media/inbound/update.json pointing to /home/openclaw/.ssh/authorized_keys. When OpenClaw's stageSandboxMedia function processes the inbound media queue during normal agent operation, it follows the symlink without validation and overwrites the SSH authorized_keys file with the attacker's public key. The attacker then authenticates via SSH using the injected key, gaining interactive host access under the OpenClaw service account. From this foothold, they modify agent tool definitions to achieve persistent code execution on every subsequent agent invocation, exfiltrate model artifacts, or pivot to other services accessible from the host.

Weaknesses (CWE)

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.