CVE-2026-32002: OpenClaw sandbox bypass exfiltrates

CISO Take

OpenClaw's sandboxed image tool fails to enforce workspaceOnly path restrictions on mounted sandbox directories, allowing a low-privileged attacker to load and read arbitrary files outside the designated workspace boundary. While the CVSS score of 5.3 appears moderate, EPSS places this in the top 77th percentile for exploitation likelihood, and the exfiltration mechanism — tunneling stolen file contents through outbound vision model provider API requests — is particularly insidious because it bypasses conventional DLP and egress controls not monitoring AI provider traffic. With 396 prior CVEs in the same package, OpenClaw represents a high-risk component in any agentic AI deployment, and any environment mounting sensitive host paths into OpenClaw sandboxes (credentials, model configs, proprietary data) should treat this as high priority. Patch to version 2026.2.23 immediately; if patching is delayed, restrict filesystem mount points and instrument vision model API calls for anomalously large or high-entropy image payloads.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 5.3 underrepresents operational risk in AI agent deployments. The EPSS 77th percentile indicates meaningful near-term exploitation probability. Attack complexity is rated High but primarily requires understanding of sandbox mechanics — accessible to adversaries with moderate AI/ML tooling knowledge. Confidentiality impact is full (C:H), and the exfiltration channel through legitimate AI provider API endpoints evades most perimeter controls, making detection significantly harder than traditional data theft. The 396 prior CVEs in OpenClaw signal a package with systemic security debt.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege authenticated access to an OpenClaw instance, sufficient to invoke agent tools including the sandboxed image tool.

AML.T0012

Sandbox Bypass

Attacker crafts image tool invocations targeting mounted sandbox paths outside the workspace, exploiting the failure to enforce tools.fs.workspaceOnly restrictions on mounted directories.

AML.T0053

Data Collection

Restricted files from mounted host paths — credentials, API keys, environment configs, proprietary data — are loaded as image objects by the sandboxed image tool.

AML.T0037

Covert Exfiltration

File contents are embedded in outbound vision model provider API requests and transmitted to an external AI service, evading perimeter controls that treat AI provider endpoints as trusted destinations.

AML.T0086

Initial Access

Attacker obtains low-privilege authenticated access to an OpenClaw instance, sufficient to invoke agent tools including the sandboxed image tool.

AML.T0012

Sandbox Bypass

Attacker crafts image tool invocations targeting mounted sandbox paths outside the workspace, exploiting the failure to enforce tools.fs.workspaceOnly restrictions on mounted directories.

AML.T0053

Data Collection

Restricted files from mounted host paths — credentials, API keys, environment configs, proprietary data — are loaded as image objects by the sandboxed image tool.

AML.T0037

Covert Exfiltration

File contents are embedded in outbound vision model provider API requests and transmitted to an external AI service, evading perimeter controls that treat AI provider endpoints as trusted destinations.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

6 steps

Patch OpenClaw to version 2026.2.23 or later immediately — see patch commit dd9d9c1c in the GitHub advisory.
If immediate patching is not possible, audit all active sandbox mount configurations and remove any mounts that extend outside the intended workspace boundary.
Apply least-privilege filesystem access: never mount host credential stores, .env files, or sensitive config directories into OpenClaw sandbox environments.
Instrument outbound vision model API requests — alert on payloads with anomalously high entropy, large base64-encoded image data, or unexpected image dimensions that don't correspond to legitimate workflow images.
Rotate any secrets or credentials stored in paths that were accessible to the sandboxed image tool.
Review OpenClaw version in downstream dependencies (4 confirmed dependents) and ensure all are patched.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Privacy Violation Auth Bypass Agent Plugin AML.T0024 - Exfiltration via AI Inference API AML.T0037 - Data from Local System AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE-4.1 - Post-deployment AI risks and impacts are evaluated and documented

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32002?

OpenClaw's sandboxed image tool fails to enforce workspaceOnly path restrictions on mounted sandbox directories, allowing a low-privileged attacker to load and read arbitrary files outside the designated workspace boundary. While the CVSS score of 5.3 appears moderate, EPSS places this in the top 77th percentile for exploitation likelihood, and the exfiltration mechanism — tunneling stolen file contents through outbound vision model provider API requests — is particularly insidious because it bypasses conventional DLP and egress controls not monitoring AI provider traffic. With 396 prior CVEs in the same package, OpenClaw represents a high-risk component in any agentic AI deployment, and any environment mounting sensitive host paths into OpenClaw sandboxes (credentials, model configs, proprietary data) should treat this as high priority. Patch to version 2026.2.23 immediately; if patching is delayed, restrict filesystem mount points and instrument vision model API calls for anomalously large or high-entropy image payloads.

Is CVE-2026-32002 actively exploited?

No confirmed active exploitation of CVE-2026-32002 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32002?

1. Patch OpenClaw to version 2026.2.23 or later immediately — see patch commit dd9d9c1c in the GitHub advisory. 2. If immediate patching is not possible, audit all active sandbox mount configurations and remove any mounts that extend outside the intended workspace boundary. 3. Apply least-privilege filesystem access: never mount host credential stores, .env files, or sensitive config directories into OpenClaw sandbox environments. 4. Instrument outbound vision model API requests — alert on payloads with anomalously high entropy, large base64-encoded image data, or unexpected image dimensions that don't correspond to legitimate workflow images. 5. Rotate any secrets or credentials stored in paths that were accessible to the sandboxed image tool. 6. Review OpenClaw version in downstream dependencies (4 confirmed dependents) and ensure all are patched.

What systems are affected by CVE-2026-32002?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Agentic AI pipelines with filesystem access, Multi-modal AI deployments with vision model integration, Sandboxed AI tool environments.

What is the CVSS score for CVE-2026-32002?

CVE-2026-32002 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksAgentic AI pipelines with filesystem accessMulti-modal AI deployments with vision model integrationSandboxed AI tool environments

MITRE ATLAS Techniques

AML.T0024 Exfiltration via AI Inference API

AML.T0037 Data from Local System

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictions on mounted sandbox paths, allowing attackers to read out-of-workspace files. Attackers can load restricted mounted images and exfiltrate them through vision model provider requests to bypass sandbox confidentiality controls.

Exploitation Scenario

A threat actor with low-privileged access to an OpenClaw instance identifies that the deployed configuration mounts a sensitive host path (e.g., /secrets or /app/.env) inside the sandbox. Using the sandboxed image tool, the attacker crafts invocations that load files from these mounted paths as image objects, exploiting the failure to validate workspaceOnly restrictions on mounted directories. The agent processes these file-as-image submissions and forwards them to the configured vision model provider API as image analysis requests. The file contents transit as legitimate AI inference traffic to an external provider endpoint, completing a covert exfiltration. Because the destination is a trusted AI service (OpenAI, Anthropic), neither firewall rules nor proxy inspection flags the egress — the attacker retrieves the file content from the vision model's response.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.