CVE-2026-32009: OpenClaw binary hijacking

CISO Take

OpenClaw prior to 2026.2.24 contains a path trust vulnerability where its safeBins execution allowlist grants blanket trust to package-manager-writable directories such as /opt/homebrew/bin and /usr/local/bin — allowing an attacker who can write to those paths to substitute a malicious binary for any allowlisted executable and achieve arbitrary code execution within the OpenClaw agent runtime. Although CVSS is medium (5.7) and exploitation requires existing local write access with elevated privileges, the EPSS percentile in the top 3% of all published CVEs signals this class of path-trust flaw is historically exploited at a much higher rate than severity alone implies, and the OpenClaw package carries 396 prior CVEs indicating persistent security hygiene issues. Because OpenClaw agents typically operate with broad tool access — API keys, filesystem, shell, outbound network — arbitrary code execution within the agent context produces a disproportionately large blast radius relative to the base CVSS score. Patch to 2026.2.24 immediately, audit /opt/homebrew/bin and /usr/local/bin for unexpected binaries, and containerize OpenClaw workloads to bound lateral movement.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Moderate severity overall, elevated in shared-access developer and CI/CD environments where write access to package-manager paths may be loosely controlled. The high-privilege prerequisite (PR:H) and local attack vector (AV:L) significantly narrow the attacker population to those already with meaningful system access, positioning this as a privilege escalation and lateral movement risk rather than an initial-access vector. However, in agentic AI infrastructure — where OpenClaw runs continuously, often with broad system permissions — the impact of arbitrary code execution within the agent context is amplified well beyond what the 5.7 CVSS reflects. The EPSS top 97th percentile warrants tracking even without a public exploit.

How does the attack unfold?

Privileged Write Access

Attacker obtains write access to /opt/homebrew/bin or /usr/local/bin via a compromised developer account, misconfigured CI runner, or malicious package postinstall script.

AML.T0012

Binary Masquerading

Attacker drops a malicious binary named identically to a tool OpenClaw regularly invokes (e.g., 'python', 'git'), shadowing the legitimate binary in the trusted path.

AML.T0074

SafeBins Policy Bypass

OpenClaw's safeBins evaluates the binary's parent directory against its static trusted-path list, approves it without integrity verification, and executes the malicious binary.

AML.T0107

Agent Runtime Compromise

Malicious binary executes within OpenClaw's agent context, exfiltrating API keys and credentials stored in the agent environment and establishing persistence or lateral movement.

AML.T0112.000

Privileged Write Access

Attacker obtains write access to /opt/homebrew/bin or /usr/local/bin via a compromised developer account, misconfigured CI runner, or malicious package postinstall script.

AML.T0012

Binary Masquerading

Attacker drops a malicious binary named identically to a tool OpenClaw regularly invokes (e.g., 'python', 'git'), shadowing the legitimate binary in the trusted path.

AML.T0074

SafeBins Policy Bypass

OpenClaw's safeBins evaluates the binary's parent directory against its static trusted-path list, approves it without integrity verification, and executes the malicious binary.

AML.T0107

Agent Runtime Compromise

Malicious binary executes within OpenClaw's agent context, exfiltrating API keys and credentials stored in the agent environment and establishing persistence or lateral movement.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.7 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR High

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch immediately: upgrade OpenClaw to 2026.2.24 or later (patch commit b67e600).
Audit trusted directories: inspect /opt/homebrew/bin, /usr/local/bin, and any other paths in OpenClaw's default safeBins list for unexpected or recently added/modified binaries — compare against known-good package manager manifests.
Harden directory permissions: ensure /usr/local/bin is root-owned and non-writable by non-admin users; restrict Homebrew prefix ownership to a dedicated service account rather than the running user.
Containerize agent workloads: run OpenClaw in minimal containers with read-only root filesystems to neutralize path-hijacking opportunities entirely.
Enable binary integrity monitoring: deploy auditd (Linux) or macOS Endpoint Security to alert on new binary writes to these directories, particularly filenames matching common tool names invoked by OpenClaw.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Supply Chain Agent Framework Plugin AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading AML.T0107 - Exploitation for Defense Evasion AML.T0110 - AI Agent Tool Poisoning AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2 - AI system security

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32009?

OpenClaw prior to 2026.2.24 contains a path trust vulnerability where its safeBins execution allowlist grants blanket trust to package-manager-writable directories such as /opt/homebrew/bin and /usr/local/bin — allowing an attacker who can write to those paths to substitute a malicious binary for any allowlisted executable and achieve arbitrary code execution within the OpenClaw agent runtime. Although CVSS is medium (5.7) and exploitation requires existing local write access with elevated privileges, the EPSS percentile in the top 3% of all published CVEs signals this class of path-trust flaw is historically exploited at a much higher rate than severity alone implies, and the OpenClaw package carries 396 prior CVEs indicating persistent security hygiene issues. Because OpenClaw agents typically operate with broad tool access — API keys, filesystem, shell, outbound network — arbitrary code execution within the agent context produces a disproportionately large blast radius relative to the base CVSS score. Patch to 2026.2.24 immediately, audit /opt/homebrew/bin and /usr/local/bin for unexpected binaries, and containerize OpenClaw workloads to bound lateral movement.

Is CVE-2026-32009 actively exploited?

No confirmed active exploitation of CVE-2026-32009 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32009?

1. Patch immediately: upgrade OpenClaw to 2026.2.24 or later (patch commit b67e600). 2. Audit trusted directories: inspect /opt/homebrew/bin, /usr/local/bin, and any other paths in OpenClaw's default safeBins list for unexpected or recently added/modified binaries — compare against known-good package manager manifests. 3. Harden directory permissions: ensure /usr/local/bin is root-owned and non-writable by non-admin users; restrict Homebrew prefix ownership to a dedicated service account rather than the running user. 4. Containerize agent workloads: run OpenClaw in minimal containers with read-only root filesystems to neutralize path-hijacking opportunities entirely. 5. Enable binary integrity monitoring: deploy auditd (Linux) or macOS Endpoint Security to alert on new binary writes to these directories, particularly filenames matching common tool names invoked by OpenClaw.

What systems are affected by CVE-2026-32009?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, CI/CD AI pipelines, developer workstations running AI agents.

What is the CVSS score for CVE-2026-32009?

CVE-2026-32009 has a CVSS v3.1 base score of 5.7 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsCI/CD AI pipelinesdeveloper workstations running AI agents

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

AML.T0107 Exploitation for Defense Evasion

AML.T0110 AI Agent Tool Poisoning

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-manager paths like /opt/homebrew/bin and /usr/local/bin. An attacker with write access to these trusted directories can place a malicious binary with the same name as an allowed executable to achieve arbitrary command execution within the OpenClaw runtime context.

Exploitation Scenario

An attacker compromises a developer account or service account with write access to /opt/homebrew/bin — possible via a prior phishing compromise, misconfigured CI runner permissions, or a malicious npm/pip package with postinstall scripts. They drop a malicious binary named 'python' (or any other tool OpenClaw is known to invoke) into /opt/homebrew/bin, shadowing the legitimate Homebrew-managed binary. When OpenClaw next invokes 'python' as part of an agentic task, its safeBins allowlist evaluates the binary's parent directory (/opt/homebrew/bin) against its static trust list and approves execution without verifying binary hash or provenance. The malicious binary runs in the OpenClaw runtime context — exfiltrating LLM API keys, cloud credentials, and any filesystem-accessible secrets — then chains to a persistent reverse shell, mirroring the credential theft pattern observed in AIID #1368.

Weaknesses (CWE)

CWE-426 Untrusted Search Path

CWE-426 — Untrusted Search Path: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.