CVE-2026-32013: OpenClaw symlink traversal enables

CISO Take

OpenClaw versions prior to 2026.2.25 contain a symlink traversal flaw in its agent file access methods (agents.files.get and agents.files.set) that allows any authenticated user with low privileges to read or write arbitrary files on the host system beyond the intended agent sandbox. With a CVSS of 8.8, network-accessible attack vector, low complexity, and no user interaction required, this is exploitable by any account holder against an OpenClaw gateway — EPSS places it in the top 54% for exploitation likelihood, and active abuse of the OpenClaw ecosystem for credential theft is already documented in AIID incident #1368. The vulnerability is especially dangerous in AI agent deployments where gateway processes commonly run with elevated OS permissions to interact with tools and external resources, turning a path traversal into a credible path to code execution via file overwrite. Organizations running OpenClaw must upgrade immediately to 2026.2.25, audit agent workspaces for existing symlinks, and tighten gateway process privileges while monitoring for file access outside workspace boundaries.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

HIGH. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) reflects a near-worst-case exploitability profile: remotely accessible with minimal authentication, trivial to execute, and delivering full confidentiality, integrity, and availability impact. AI agent gateways typically hold privileged access to host resources — API keys, database credentials, SSH keys, and configuration — amplifying impact well beyond a standard path traversal. The package's history of 396 prior CVEs and AIID-documented active exploitation of the OpenClaw skill ecosystem raise the likelihood that adversaries are already probing this surface. No public exploit or CISA KEV listing yet, but the attack technique (symlink plant + API call) requires no AI-specific knowledge and is reproducible by script-level adversaries.

How does the attack unfold?

Initial Access

Attacker authenticates to the OpenClaw gateway API using any valid low-privilege account, gaining access to agent file operation methods.

AML.T0049

Symlink Plant

Attacker creates or uploads a symlink within their allowlisted agent workspace that resolves to a sensitive host file outside the workspace boundary, such as the application .env or an SSH private key.

AML.T0105

Traversal Exploitation

Attacker calls agents.files.get on the symlinked filename; OpenClaw follows the symlink without validating the resolved path, returning the contents of the arbitrary host file to the attacker.

AML.T0053

Impact: Exfiltration or RCE

Attacker exfiltrates credentials and API keys via agents.files.get, or uses agents.files.set to overwrite a host cron job or startup script with a reverse shell payload, achieving persistent code execution.

AML.T0086

Initial Access

Attacker authenticates to the OpenClaw gateway API using any valid low-privilege account, gaining access to agent file operation methods.

AML.T0049

Symlink Plant

Attacker creates or uploads a symlink within their allowlisted agent workspace that resolves to a sensitive host file outside the workspace boundary, such as the application .env or an SSH private key.

AML.T0105

Traversal Exploitation

Attacker calls agents.files.get on the symlinked filename; OpenClaw follows the symlink without validating the resolved path, returning the contents of the arbitrary host file to the attacker.

AML.T0053

Impact: Exfiltration or RCE

Attacker exfiltrates credentials and API keys via agents.files.get, or uses agents.files.set to overwrite a host cron job or startup script with a reverse shell payload, achieving persistent code execution.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch immediately: upgrade OpenClaw to 2026.2.25 or later (patch commit 125f4071bcbc0de32e769940d07967db47f09d3d addresses the symlink validation gap).
Audit existing workspaces: run 'find <workspace_root> -type l' to enumerate symlinks in all agent workspaces and remove any resolving outside workspace boundaries.
Restrict gateway process permissions: run OpenClaw gateway under a dedicated low-privilege service account scoped to workspace directories only, using OS-level access controls to prevent access to sensitive host paths.
Deploy file integrity monitoring (FIM): alert on read or write access to sensitive host paths (credential files, /etc/, startup scripts) originating from gateway process PIDs.
Enforce allowlist path canonicalization: as a defense-in-depth measure, validate that resolved symlink targets (via realpath()) remain under the allowlisted workspace root before serving them — this mirrors the patch logic.
Restrict API access: ensure the OpenClaw gateway API is not exposed to unauthenticated or broad-network access; apply network segmentation to limit which accounts can invoke agents.files.* methods.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Extraction Auth Bypass Agent Plugin Framework AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

6.1.2 - AI Risk Assessment 8.4 - AI System Security

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain oversight and control of AI system operations

OWASP LLM Top 10

LLM06:2025 - Sensitive Information Disclosure LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32013?

OpenClaw versions prior to 2026.2.25 contain a symlink traversal flaw in its agent file access methods (agents.files.get and agents.files.set) that allows any authenticated user with low privileges to read or write arbitrary files on the host system beyond the intended agent sandbox. With a CVSS of 8.8, network-accessible attack vector, low complexity, and no user interaction required, this is exploitable by any account holder against an OpenClaw gateway — EPSS places it in the top 54% for exploitation likelihood, and active abuse of the OpenClaw ecosystem for credential theft is already documented in AIID incident #1368. The vulnerability is especially dangerous in AI agent deployments where gateway processes commonly run with elevated OS permissions to interact with tools and external resources, turning a path traversal into a credible path to code execution via file overwrite. Organizations running OpenClaw must upgrade immediately to 2026.2.25, audit agent workspaces for existing symlinks, and tighten gateway process privileges while monitoring for file access outside workspace boundaries.

Is CVE-2026-32013 actively exploited?

No confirmed active exploitation of CVE-2026-32013 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32013?

1. Patch immediately: upgrade OpenClaw to 2026.2.25 or later (patch commit 125f4071bcbc0de32e769940d07967db47f09d3d addresses the symlink validation gap). 2. Audit existing workspaces: run 'find <workspace_root> -type l' to enumerate symlinks in all agent workspaces and remove any resolving outside workspace boundaries. 3. Restrict gateway process permissions: run OpenClaw gateway under a dedicated low-privilege service account scoped to workspace directories only, using OS-level access controls to prevent access to sensitive host paths. 4. Deploy file integrity monitoring (FIM): alert on read or write access to sensitive host paths (credential files, /etc/, startup scripts) originating from gateway process PIDs. 5. Enforce allowlist path canonicalization: as a defense-in-depth measure, validate that resolved symlink targets (via realpath()) remain under the allowlisted workspace root before serving them — this mirrors the patch logic. 6. Restrict API access: ensure the OpenClaw gateway API is not exposed to unauthenticated or broad-network access; apply network segmentation to limit which accounts can invoke agents.files.* methods.

What systems are affected by CVE-2026-32013?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent deployments, multi-tenant AI platforms, model serving.

What is the CVSS score for CVE-2026-32013?

CVE-2026-32013 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent deploymentsmulti-tenant AI platformsmodel serving

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 6.1.2, 8.4

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06:2025, LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside the agent workspace. Attackers can exploit symlinked allowlisted files to access arbitrary host files within gateway process permissions, potentially enabling code execution through file overwrite attacks.

Exploitation Scenario

An attacker with a valid low-privilege OpenClaw account uploads a symlink named 'config.json' into their agent workspace, configured to resolve to /opt/aithreatintel/.env on the host — a file containing database credentials, Stripe API keys, and Resend tokens. The attacker calls agents.files.get targeting 'config.json'; OpenClaw follows the symlink without verifying the resolved path against the workspace root, returning the full contents of the host .env file. The attacker exfiltrates all secrets. For code execution, the attacker follows up with agents.files.set to overwrite /etc/cron.d/aithreatintel with a payload that spawns a reverse shell on the next cron cycle. The entire attack chain requires only a valid account, standard HTTP calls to the agent API, and a symlink — no AI/ML expertise, no public exploit tooling, and no elevated privileges beyond the initial low-privilege account.

Weaknesses (CWE)

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.