CVE-2026-32008: OpenClaw file:// bypass enables

CISO Take

OpenClaw's browser tool fails to block file:// URLs in its assertBrowserNavigationAllowed() guard, allowing any authenticated user with browser-tool permissions to read arbitrary local files accessible to the agent process account. This matters because AI agents routinely run with access to sensitive files — API keys, credential stores, configuration files — making the effective confidentiality blast radius far larger than the CVSS 6.5 score implies; with EPSS placing this in the top 68th percentile and a low-complexity, no-interaction attack path, the likelihood of opportunistic abuse inside multi-tenant or shared agent deployments is real. The OpenClaw ecosystem has already been targeted for credential exfiltration via malicious skills (AIID #1368), signaling that threat actors are actively probing this attack surface. Upgrade to OpenClaw 2026.2.21 or later immediately; as an interim control, restrict browser-tool access to the minimum required set of trusted users and audit the filesystem permissions of the process account running OpenClaw.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium CVSS score understates operational risk in AI agent deployments. Attack complexity is low, privileges required are minimal (any authenticated user), and no user interaction is needed — meaning the barrier to exploitation inside a shared agent platform is essentially 'have a valid account'. Confidentiality impact is rated HIGH because agents typically run with access to environment files, SSH keys, and service credentials. With 4 downstream dependents and 396 historical CVEs in the same package, the OpenClaw codebase shows a pattern of structural security debt. EPSS at 68th percentile without a public exploit suggests the vulnerability class is well understood by attackers even before a PoC surfaces. Not currently in CISA KEV, but the adjacent AIID #1368 incident demonstrates active attacker interest in the OpenClaw ecosystem specifically.

How does the attack unfold?

Authenticated Access

Attacker obtains a low-privilege account on a shared OpenClaw deployment and is granted browser-tool access, satisfying the PR:L requirement.

AML.T0012

URL Scheme Bypass

Attacker invokes the browser tool with a file:// URL (e.g., file:///home/agent/.env); assertBrowserNavigationAllowed() fails to reject the scheme and permits navigation.

AML.T0053

Local File Collection

Browser snapshot and extraction actions capture the contents of the targeted local file — credential files, API keys, SSH keys, or database connection strings — and return them inline to the attacker.

AML.T0037

Credential Exfiltration

Attacker uses harvested credentials (cloud keys, API tokens, DB passwords) to pivot laterally to connected infrastructure, escalating impact far beyond the OpenClaw instance.

AML.T0086

Authenticated Access

Attacker obtains a low-privilege account on a shared OpenClaw deployment and is granted browser-tool access, satisfying the PR:L requirement.

AML.T0012

URL Scheme Bypass

Attacker invokes the browser tool with a file:// URL (e.g., file:///home/agent/.env); assertBrowserNavigationAllowed() fails to reject the scheme and permits navigation.

AML.T0053

Local File Collection

Browser snapshot and extraction actions capture the contents of the targeted local file — credential files, API keys, SSH keys, or database connection strings — and return them inline to the attacker.

AML.T0037

Credential Exfiltration

Attacker uses harvested credentials (cloud keys, API tokens, DB passwords) to pivot laterally to connected infrastructure, escalating impact far beyond the OpenClaw instance.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade to OpenClaw >= 2026.2.21 immediately (fix in commit 220bd95).
Workaround: Restrict browser-tool access to the minimum required set of users via role/permission controls — do not grant it by default.
Harden the process account: Run the OpenClaw process under a dedicated low-privilege service account with no access to credential files, home directories, or sensitive config paths; use filesystem ACLs or namespacing (e.g., Docker with volume restrictions) to enforce this.
Detection: Audit OpenClaw access logs for browser navigation requests containing file:// scheme — a legitimate browser tool should never need file:// access. Alert on any snapshot or extraction action referencing local paths.
Secret hygiene: Rotate any secrets stored in files accessible to the OpenClaw process account as a precaution if the instance has had untrusted authenticated users.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Privacy Violation Agent Plugin AML.T0037 - Data from Local System AML.T0053 - AI Agent Tool Invocation AML.T0085.001 - AI Agent Tools AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

8.4 - AI System Operation

NIST AI RMF

MANAGE-2.2 - Risk Treatment — AI Risk Response

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32008?

OpenClaw's browser tool fails to block file:// URLs in its assertBrowserNavigationAllowed() guard, allowing any authenticated user with browser-tool permissions to read arbitrary local files accessible to the agent process account. This matters because AI agents routinely run with access to sensitive files — API keys, credential stores, configuration files — making the effective confidentiality blast radius far larger than the CVSS 6.5 score implies; with EPSS placing this in the top 68th percentile and a low-complexity, no-interaction attack path, the likelihood of opportunistic abuse inside multi-tenant or shared agent deployments is real. The OpenClaw ecosystem has already been targeted for credential exfiltration via malicious skills (AIID #1368), signaling that threat actors are actively probing this attack surface. Upgrade to OpenClaw 2026.2.21 or later immediately; as an interim control, restrict browser-tool access to the minimum required set of trusted users and audit the filesystem permissions of the process account running OpenClaw.

Is CVE-2026-32008 actively exploited?

No confirmed active exploitation of CVE-2026-32008 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32008?

1. Patch: Upgrade to OpenClaw >= 2026.2.21 immediately (fix in commit 220bd95). 2. Workaround: Restrict browser-tool access to the minimum required set of users via role/permission controls — do not grant it by default. 3. Harden the process account: Run the OpenClaw process under a dedicated low-privilege service account with no access to credential files, home directories, or sensitive config paths; use filesystem ACLs or namespacing (e.g., Docker with volume restrictions) to enforce this. 4. Detection: Audit OpenClaw access logs for browser navigation requests containing file:// scheme — a legitimate browser tool should never need file:// access. Alert on any snapshot or extraction action referencing local paths. 5. Secret hygiene: Rotate any secrets stored in files accessible to the OpenClaw process account as a precaution if the instance has had untrusted authenticated users.

What systems are affected by CVE-2026-32008?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-agent orchestration systems, AI agents with browser tool access, Agentic pipelines with filesystem-adjacent credential storage.

What is the CVSS score for CVE-2026-32008?

CVE-2026-32008 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMulti-agent orchestration systemsAI agents with browser tool accessAgentic pipelines with filesystem-adjacent credential storage

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0053 AI Agent Tool Invocation

AML.T0085.001 AI Agent Tools

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:// URLs. Attackers can exploit this by accessing local files readable by the OpenClaw process user through browser snapshot and extraction actions to exfiltrate sensitive data.

Exploitation Scenario

An attacker with a valid low-privilege account on a shared OpenClaw deployment invokes the browser tool and navigates to file:///etc/passwd or file:///home/agent/.env. The assertBrowserNavigationAllowed() function fails to reject the file:// scheme and permits navigation. The attacker uses the browser snapshot action to capture the rendered file contents and the extraction action to pull structured text. From .env they recover OPENAI_API_KEY, DATABASE_URL with credentials, and STRIPE_SECRET_KEY. They repeat the process for ~/.ssh/id_rsa and ~/.aws/credentials. With these credentials they pivot laterally to the connected cloud environment and billing infrastructure — all from a single authenticated API call requiring no special AI or ML expertise.

Weaknesses (CWE)

CWE-610 Externally Controlled Reference to a Resource in Another Sphere

CWE-610 — Externally Controlled Reference to a Resource in Another Sphere: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Source: MITRE CWE corpus.