CVE-2026-31997: OpenClaw post-approval PATH rebind

CISO Take

OpenClaw before 2026.3.1 contains a time-of-check/time-of-use flaw in its system.run approval gate: when an operator approves a bare token (non-path argv[0]) rather than an absolute binary path, executable identity is not pinned at approval time, allowing an attacker with local low-privilege access to manipulate PATH after approval and substitute a malicious binary before execution fires. Despite a medium CVSS of 6.0 and low raw EPSS score (0.00091), the confidentiality and integrity impact upon successful exploitation is rated HIGH — meaning the agent's full process context, including any credentials, configuration, or connected infrastructure it can reach, is exposed. OpenClaw already carries 396 published CVEs and its skill ecosystem has seen confirmed malicious abuse leading to credential theft in the wild (AIID #1368), establishing that this package's execution surface is an active target. Upgrade to OpenClaw 2026.3.1 immediately; where patching is delayed, enforce absolute paths in all system.run approvals and restrict PATH to root-owned, immutable directories.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Practical exploitability is constrained by three factors: local access requirement, high attack complexity (TOCTOU timing window), and mandatory operator interaction for the approval trigger. However, once those preconditions align, the impact is severe — C:H/I:H with no scope change. OpenClaw's accumulated CVE history (396 prior disclosures), confirmed ecosystem-level abuse in the wild, and the structural insecurity of token-based approval without executable identity pinning collectively elevate this beyond its nominal CVSS 6.0 surface rating for any organization running OpenClaw agents with system.run enabled. The attack requires no AI/ML expertise — only knowledge of PATH resolution and a brief timing window.

How does the attack unfold?

Local Access

Attacker obtains low-privilege local access to a host running an OpenClaw AI agent with system.run capability enabled.

AML.T0012

Approval Baiting

Attacker waits for or engineers a workflow that prompts the operator to approve a system.run command using a bare token (e.g., 'python') rather than an absolute path.

AML.T0011

PATH Hijack

In the window after operator approval but before execution, attacker prepends a writable directory containing a malicious binary matching the approved token name to the PATH environment.

AML.T0074

Arbitrary Execution

OpenClaw resolves the approved token via the manipulated PATH and executes the attacker's binary instead of the legitimate one, achieving arbitrary code execution under the agent's privilege context.

AML.T0053

Local Access

Attacker obtains low-privilege local access to a host running an OpenClaw AI agent with system.run capability enabled.

AML.T0012

Approval Baiting

Attacker waits for or engineers a workflow that prompts the operator to approve a system.run command using a bare token (e.g., 'python') rather than an absolute path.

AML.T0011

PATH Hijack

In the window after operator approval but before execution, attacker prepends a writable directory containing a malicious binary matching the approved token name to the PATH environment.

AML.T0074

Arbitrary Execution

OpenClaw resolves the approved token via the manipulated PATH and executes the attacker's binary instead of the legitimate one, achieving arbitrary code execution under the agent's privilege context.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.0 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI Required

S Unchanged

C High

I High

A None

What should I do?

6 steps

Patch: upgrade OpenClaw to 2026.3.1 or later, which pins executable identity at approval time.
Workaround if patching is delayed: enforce a policy requiring absolute paths for all system.run approvals — reject any bare token argv[0] entries at the configuration level.
Harden PATH: prior to agent execution, restrict PATH to root-owned, immutable directories to prevent post-approval prepending of attacker-controlled entries.
Audit: review all existing system.run approval entries for non-path-like tokens and revoke them.
Least privilege: run OpenClaw agent processes under OS accounts with minimal PATH exposure and restricted write access to directories on PATH.
Detection: monitor process execution logs for unexpected binary invocations under the OpenClaw process tree, particularly for common interpreter names (python, node, sh) launched from non-standard paths.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0011 - User Execution AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system integrity during operation

NIST AI RMF

MANAGE 2.2 - Mechanisms to detect and respond to AI risks

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-31997?

OpenClaw before 2026.3.1 contains a time-of-check/time-of-use flaw in its system.run approval gate: when an operator approves a bare token (non-path argv[0]) rather than an absolute binary path, executable identity is not pinned at approval time, allowing an attacker with local low-privilege access to manipulate PATH after approval and substitute a malicious binary before execution fires. Despite a medium CVSS of 6.0 and low raw EPSS score (0.00091), the confidentiality and integrity impact upon successful exploitation is rated HIGH — meaning the agent's full process context, including any credentials, configuration, or connected infrastructure it can reach, is exposed. OpenClaw already carries 396 published CVEs and its skill ecosystem has seen confirmed malicious abuse leading to credential theft in the wild (AIID #1368), establishing that this package's execution surface is an active target. Upgrade to OpenClaw 2026.3.1 immediately; where patching is delayed, enforce absolute paths in all system.run approvals and restrict PATH to root-owned, immutable directories.

Is CVE-2026-31997 actively exploited?

No confirmed active exploitation of CVE-2026-31997 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31997?

1. Patch: upgrade OpenClaw to 2026.3.1 or later, which pins executable identity at approval time. 2. Workaround if patching is delayed: enforce a policy requiring absolute paths for all system.run approvals — reject any bare token argv[0] entries at the configuration level. 3. Harden PATH: prior to agent execution, restrict PATH to root-owned, immutable directories to prevent post-approval prepending of attacker-controlled entries. 4. Audit: review all existing system.run approval entries for non-path-like tokens and revoke them. 5. Least privilege: run OpenClaw agent processes under OS accounts with minimal PATH exposure and restricted write access to directories on PATH. 6. Detection: monitor process execution logs for unexpected binary invocations under the OpenClaw process tree, particularly for common interpreter names (python, node, sh) launched from non-standard paths.

What systems are affected by CVE-2026-31997?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic workflows with tool execution, local AI agent deployments with operator approval workflows.

What is the CVSS score for CVE-2026-31997?

CVE-2026-31997 has a CVSS v3.1 base score of 6.0 (MEDIUM). The EPSS exploitation probability is 0.09%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic workflows with tool executionlocal AI agent deployments with operator approval workflows

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute a different binary than the operator approved, enabling arbitrary command execution.

Exploitation Scenario

An attacker with low-privilege local access on a host running an OpenClaw agent waits for or engineers a workflow that prompts an operator to approve a system.run command using a bare token — for example, 'python' to invoke a data processing script. The operator approves the command via the UI. In the window between approval and execution, the attacker prepends a writable directory (e.g., /tmp/evil) containing a malicious binary named 'python' to the PATH environment variable for the agent process. When system.run fires, OpenClaw resolves 'python' via the now-manipulated PATH and executes the attacker's binary instead of the legitimate interpreter, achieving arbitrary code execution under the agent's privilege context — potentially exfiltrating API keys, model configuration, or accessing connected AI infrastructure.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.