CVE-2026-31996: OpenClaw safeBins bypass

CISO Take

CVE-2026-31996 is an input validation bypass in OpenClaw's tools.exec.safeBins component that lets an attacker circumvent stdin-only restrictions by abusing standard Unix flags — sort -o for arbitrary file writes and grep -R for recursive filesystem reads. Though the CVSS is 4.4 (Medium) with a local attack vector, the EPSS places this in the 96th percentile for exploitation likelihood, and abuse of OpenClaw's tool ecosystem is already documented in the real world: AIID incident #1368 describes malicious OpenClaw skills used to exfiltrate credentials via ClawHub. Because AI agents like OpenClaw are designed to run with broad filesystem and environment access to complete agentic tasks, a low-privileged local attacker can leverage this bypass to read sensitive configuration files, agent secrets, or training data, and write backdoors or tamper with outputs — all within the trusted execution context of the agent. Organizations running OpenClaw should upgrade immediately to 2026.2.19 or later, and audit tool execution logs for unexpected sort -o or grep -R invocations.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Risk is MEDIUM-HIGH in AI agent deployment contexts despite the baseline CVSS of 4.4. The local attack vector and low privileges required are realistic in multi-tenant environments, containerized agent runtimes, or scenarios where an attacker has achieved any foothold on the host. The 96th EPSS percentile signals this class of vulnerability attracts disproportionate attacker interest. The specific danger for AI/ML environments is that OpenClaw agents frequently run with elevated trust — access to model weights, API keys, RAG databases, and environment variables — meaning the blast radius of a successful file-read or file-write exceeds what the CVSS base score implies for traditional software.

How does the attack unfold?

Initial Access

Attacker obtains low-privileged local execution on a host running an OpenClaw AI agent, either through a separate vulnerability, legitimate user credentials, or a malicious OpenClaw skill published to ClawHub.

AML.T0012

Validation Bypass

Attacker invokes OpenClaw tool calls with crafted arguments (sort -o <target_path> or grep -R /) that bypass safeBins stdin-only restrictions, escalating tool access beyond intended boundaries.

AML.T0053

Data Collection

Using grep -R, attacker recursively reads the filesystem to harvest API keys, database credentials, agent configuration, model artifacts, and system prompts stored in environment files accessible to the agent process.

AML.T0037

Persistence / Impact

Using sort -o, attacker writes backdoored configuration files, corrupts agent behavior definitions, or plants files that enable follow-on access — all within the trusted execution context of the AI agent.

AML.T0101

Initial Access

Attacker obtains low-privileged local execution on a host running an OpenClaw AI agent, either through a separate vulnerability, legitimate user credentials, or a malicious OpenClaw skill published to ClawHub.

AML.T0012

Validation Bypass

Attacker invokes OpenClaw tool calls with crafted arguments (sort -o <target_path> or grep -R /) that bypass safeBins stdin-only restrictions, escalating tool access beyond intended boundaries.

AML.T0053

Data Collection

Using grep -R, attacker recursively reads the filesystem to harvest API keys, database credentials, agent configuration, model artifacts, and system prompts stored in environment files accessible to the agent process.

AML.T0037

Persistence / Impact

Using sort -o, attacker writes backdoored configuration files, corrupts agent behavior definitions, or plants files that enable follow-on access — all within the trusted execution context of the AI agent.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.4 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.2.19 or later per the vendor advisory (GHSA-4685-c5cp-vp95).
Detect: Audit tool execution logs for invocations of sort with -o flag or grep with -R/-r flags that were not explicitly part of expected agent task definitions.
Contain: Apply least-privilege principles to OpenClaw agent processes — restrict filesystem access via OS-level controls (chroot, seccomp, read-only mounts) so even a successful bypass cannot reach sensitive paths.
Rotate: If exposure is suspected, rotate all credentials accessible to the agent process (API keys, DB passwords, tokens in environment variables).
Monitor: Enable alerting on unexpected file creation or modification events in agent working directories.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Extraction Auth Bypass Agent Plugin AML.T0037 - Data from Local System AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10.2 - Suppliers and third parties of AI systems — verification A.6.2 - AI system security objectives

NIST AI RMF

MANAGE 2.2 - Mechanisms for tracking and managing AI risks

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-31996?

CVE-2026-31996 is an input validation bypass in OpenClaw's tools.exec.safeBins component that lets an attacker circumvent stdin-only restrictions by abusing standard Unix flags — sort -o for arbitrary file writes and grep -R for recursive filesystem reads. Though the CVSS is 4.4 (Medium) with a local attack vector, the EPSS places this in the 96th percentile for exploitation likelihood, and abuse of OpenClaw's tool ecosystem is already documented in the real world: AIID incident #1368 describes malicious OpenClaw skills used to exfiltrate credentials via ClawHub. Because AI agents like OpenClaw are designed to run with broad filesystem and environment access to complete agentic tasks, a low-privileged local attacker can leverage this bypass to read sensitive configuration files, agent secrets, or training data, and write backdoors or tamper with outputs — all within the trusted execution context of the agent. Organizations running OpenClaw should upgrade immediately to 2026.2.19 or later, and audit tool execution logs for unexpected sort -o or grep -R invocations.

Is CVE-2026-31996 actively exploited?

No confirmed active exploitation of CVE-2026-31996 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31996?

1. Patch: Upgrade OpenClaw to version 2026.2.19 or later per the vendor advisory (GHSA-4685-c5cp-vp95). 2. Detect: Audit tool execution logs for invocations of sort with -o flag or grep with -R/-r flags that were not explicitly part of expected agent task definitions. 3. Contain: Apply least-privilege principles to OpenClaw agent processes — restrict filesystem access via OS-level controls (chroot, seccomp, read-only mounts) so even a successful bypass cannot reach sensitive paths. 4. Rotate: If exposure is suspected, rotate all credentials accessible to the agent process (API keys, DB passwords, tokens in environment variables). 5. Monitor: Enable alerting on unexpected file creation or modification events in agent working directories.

What systems are affected by CVE-2026-31996?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, agentic pipelines with shell tool access, multi-agent orchestration systems, RAG pipelines with filesystem-integrated retrieval, local AI development environments.

What is the CVSS score for CVE-2026-31996?

CVE-2026-31996 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksagentic pipelines with shell tool accessmulti-agent orchestration systemsRAG pipelines with filesystem-integrated retrievallocal AI development environments

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.2, A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesystem operations through sort output flags or recursive grep flags. Attackers with command execution access can leverage sort -o flag for arbitrary file writes or grep -R flag for recursive file reads, circumventing intended stdin-only restrictions.

Exploitation Scenario

An attacker with a low-privileged shell on a host running an OpenClaw-powered AI agent identifies that the agent exposes a task execution interface. They submit a crafted tool call invoking sort with the -o flag pointing to a writable path (e.g., overwriting the agent's configuration file with a backdoored version, or writing a cron job). Alternatively, they invoke grep -R / to recursively read the filesystem from root, capturing .env files containing OPENAI_API_KEY or DATABASE_URL values stored by the agent's orchestration layer. Because safeBins was intended to restrict these tools to stdin-only operation, the bypass allows full flag usage without triggering the validation guard. With credentials in hand, the attacker pivots to the organization's AI services, cloud accounts, or downstream databases — consistent with the credential exfiltration pattern observed in AIID #1368.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.