CVE-2026-32007: OpenClaw path traversal enables

CISO Take

CVE-2026-32007 is a path traversal flaw (CWE-22) in OpenClaw's experimental apply_patch tool that allows an attacker with low-privilege sandbox access to read and write arbitrary files outside the designated workspace by exploiting inconsistent enforcement of workspace boundary checks on mounted paths. While the CVSS score is 6.8 (Medium) with high attack complexity, the EPSS percentile places this in the top 72% of vulnerabilities most likely to be exploited, and the AI agent category means a successful exploit directly undermines the sandbox isolation operators rely on to contain agentic behavior — a disproportionate blast radius for its base score. The history of 396 CVEs in the OpenClaw package signals systemic security debt and suggests the attack surface extends well beyond this single flaw. Upgrade OpenClaw to version 2026.2.23 or later immediately, enforce read-only mounts for all paths outside the workspace root, and audit filesystem mount configurations for any writable paths accessible to the agent process.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity with meaningful exploitation probability above what the CVSS alone conveys. Attack complexity is High, requiring specific knowledge of sandbox mounted path configurations, but privileges required are only Low — an attacker already inside the sandbox via a compromised skill, malicious plugin, or prompt injection can leverage this to escape containment entirely. The EPSS top 72% percentile elevates practical risk. The absence of public exploits and KEV listing reduces immediate urgency, but the nature of the flaw — sandbox escape in an AI agent framework — means the blast radius upon exploitation is significant: host filesystem access from within a containerized AI agent can expose credentials, model weights, training data, and enable persistence mechanisms invisible to agent-level monitoring.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege access to an OpenClaw sandbox by injecting a malicious skill via the ClawHub ecosystem, exploiting a separate vulnerability, or delivering indirect prompt injection through content ingested by the agent.

AML.T0011.002

Tool Invocation

Attacker crafts a malicious apply_patch operation embedding path traversal sequences (e.g., ../../../../etc/ or ../../../../root/.ssh/) targeting files on host-mounted paths outside the workspace root.

AML.T0053

Sandbox Escape

The inconsistently enforced workspace boundary check fails to reject the traversal on mounted paths, allowing the patch operation to read or write arbitrary files on the host filesystem beyond the container boundary.

AML.T0105

Impact

Attacker exfiltrates credentials, API keys, or model weights from mounted host directories, or establishes persistence by modifying host system files such as cron jobs or SSH authorized_keys, enabling lateral movement beyond the agent environment.

AML.T0086

Initial Access

Attacker obtains low-privilege access to an OpenClaw sandbox by injecting a malicious skill via the ClawHub ecosystem, exploiting a separate vulnerability, or delivering indirect prompt injection through content ingested by the agent.

AML.T0011.002

Tool Invocation

Attacker crafts a malicious apply_patch operation embedding path traversal sequences (e.g., ../../../../etc/ or ../../../../root/.ssh/) targeting files on host-mounted paths outside the workspace root.

AML.T0053

Sandbox Escape

The inconsistently enforced workspace boundary check fails to reject the traversal on mounted paths, allowing the patch operation to read or write arbitrary files on the host filesystem beyond the container boundary.

AML.T0105

Impact

Attacker exfiltrates credentials, API keys, or model weights from mounted host directories, or establishes persistence by modifying host system files such as cron jobs or SSH authorized_keys, enabling lateral movement beyond the agent environment.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

7 steps

Patch: Upgrade OpenClaw to 2026.2.23 or later (patch commit 6634030b fixes workspace boundary enforcement).
Workaround: Disable the experimental apply_patch tool in OpenClaw configuration if not operationally required.
Harden mounts: Enforce read-only mount flags for all host paths exposed to the OpenClaw container; eliminate unnecessary writable mounts entirely; use minimal, scoped volume mounts restricted to the workspace root.
Least privilege: Run the OpenClaw process under a restricted user without write access to sensitive host paths.
Network segmentation: Limit what a compromised OpenClaw sandbox can reach on the network to reduce post-escape lateral movement options.
Detection: Monitor for file access or writes originating from the OpenClaw process outside the designated workspace directory; alert on unexpected access to mounted paths beyond /workspace or the configured workspace root.
Audit: Inventory all OpenClaw deployments and review each for writable host mounts that extend beyond the workspace root.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Data Extraction Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32007?

CVE-2026-32007 is a path traversal flaw (CWE-22) in OpenClaw's experimental apply_patch tool that allows an attacker with low-privilege sandbox access to read and write arbitrary files outside the designated workspace by exploiting inconsistent enforcement of workspace boundary checks on mounted paths. While the CVSS score is 6.8 (Medium) with high attack complexity, the EPSS percentile places this in the top 72% of vulnerabilities most likely to be exploited, and the AI agent category means a successful exploit directly undermines the sandbox isolation operators rely on to contain agentic behavior — a disproportionate blast radius for its base score. The history of 396 CVEs in the OpenClaw package signals systemic security debt and suggests the attack surface extends well beyond this single flaw. Upgrade OpenClaw to version 2026.2.23 or later immediately, enforce read-only mounts for all paths outside the workspace root, and audit filesystem mount configurations for any writable paths accessible to the agent process.

Is CVE-2026-32007 actively exploited?

No confirmed active exploitation of CVE-2026-32007 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32007?

1. Patch: Upgrade OpenClaw to 2026.2.23 or later (patch commit 6634030b fixes workspace boundary enforcement). 2. Workaround: Disable the experimental apply_patch tool in OpenClaw configuration if not operationally required. 3. Harden mounts: Enforce read-only mount flags for all host paths exposed to the OpenClaw container; eliminate unnecessary writable mounts entirely; use minimal, scoped volume mounts restricted to the workspace root. 4. Least privilege: Run the OpenClaw process under a restricted user without write access to sensitive host paths. 5. Network segmentation: Limit what a compromised OpenClaw sandbox can reach on the network to reduce post-escape lateral movement options. 6. Detection: Monitor for file access or writes originating from the OpenClaw process outside the designated workspace directory; alert on unexpected access to mounted paths beyond /workspace or the configured workspace root. 7. Audit: Inventory all OpenClaw deployments and review each for writable host mounts that extend beyond the workspace root.

What systems are affected by CVE-2026-32007?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, AI agent sandboxes with host volume mounts, RAG pipelines with mounted document or vector stores, Training pipelines with mounted datasets, Model serving environments with shared host filesystem mounts.

What is the CVSS score for CVE-2026-32007?

CVE-2026-32007 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksAI agent sandboxes with host volume mountsRAG pipelines with mounted document or vector storesTraining pipelines with mounted datasetsModel serving environments with shared host filesystem mounts

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply_patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Exploitation Scenario

An adversary who has achieved low-privilege access to an OpenClaw sandbox — for example through a malicious third-party skill injected via the ClawHub ecosystem (as documented in AIID #1368) or via indirect prompt injection in content retrieved by the agent — crafts an apply_patch operation with path traversal sequences such as ../../../../root/.ssh/authorized_keys or ../../../../etc/cron.d/backdoor. Because the workspace-only check is inconsistently enforced on mounted paths, the patch operation traverses the sandbox boundary and modifies the targeted file on the host filesystem. The attacker can use this to establish persistence by injecting SSH keys or cron jobs, exfiltrate sensitive data from mounted model weight or configuration directories, or poison training datasets in mounted data pipelines — all without triggering agent-level security controls that only audit workspace-scoped operations.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.