CVE-2026-32016: OpenClaw path bypass

CISO Take

OpenClaw, an AI agent execution framework, contains a path validation bypass in its exec-approval allowlist mode on macOS that allows a local attacker with low privileges to run arbitrary binaries by exploiting basename-only allowlist matching — placing a malicious binary named 'echo' in the working directory causes it to execute instead of the system's '/usr/bin/echo' without triggering an approval prompt. For security teams managing AI agent deployments, this is high-risk: AI coding assistants and autonomous agents routinely execute shell commands with broad permissions in environments containing API keys, cloud credentials, and LLM tokens, and this trivially-exploited bypass can be weaponized for credential theft or persistence on developer workstations and CI/CD runners. The EPSS score places this in the top 98th percentile for exploitation likelihood among similarly-scored CVEs, and the linked AIID incident #1368 confirms that OpenClaw's execution ecosystem is actively targeted by credential stealers — making this more than a theoretical risk. Patch to OpenClaw ≥ 2026.2.22 immediately; as an interim workaround, disable 'ask=on-miss' or move away from allowlist security mode, and rotate credentials accessible from affected agent environments.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 7.8 High with local attack vector, low complexity, and low privilege requirement — accessible to any unprivileged local user or process on the affected host. In AI agent deployments, this is particularly dangerous because agents frequently run in environments with access to LLM API keys, cloud provider tokens, and CI/CD secrets. CWE-426 (Untrusted Search Path) is a well-understood and easy-to-weaponize vulnerability class requiring no AI/ML expertise to exploit. EPSS 98th percentile signals elevated relative exploitation probability despite the low raw score. No public exploit or scanner template exists yet, but the attack pattern is trivially replicable. Four downstream package dependents may inherit exposure if they invoke OpenClaw under allowlist mode.

How does the attack unfold?

Staging

Attacker places a malicious binary with a basename matching an allowlisted entry (e.g., 'echo') in the working directory of a host running OpenClaw under 'security=allowlist' mode.

AML.T0079

Defense Evasion

OpenClaw's basename-only allowlist check matches './echo' against the allowlisted '/usr/bin/echo' entry, silently approving execution without triggering an 'ask=on-miss' prompt.

AML.T0107

Execution

The malicious binary executes with the OpenClaw agent's process permissions, gaining access to environment variables, filesystem resources, and secrets available in the agent context.

AML.T0053

Impact

Attacker harvests LLM API keys, cloud credentials, and repository tokens from the agent's environment, exfiltrates them, and optionally establishes persistence on the compromised developer or CI/CD host.

AML.T0112.000

Staging

Attacker places a malicious binary with a basename matching an allowlisted entry (e.g., 'echo') in the working directory of a host running OpenClaw under 'security=allowlist' mode.

AML.T0079

Defense Evasion

OpenClaw's basename-only allowlist check matches './echo' against the allowlisted '/usr/bin/echo' entry, silently approving execution without triggering an 'ask=on-miss' prompt.

AML.T0107

Execution

The malicious binary executes with the OpenClaw agent's process permissions, gaining access to environment variables, filesystem resources, and secrets available in the agent context.

AML.T0053

Impact

Attacker harvests LLM API keys, cloud credentials, and repository tokens from the agent's environment, exfiltrates them, and optionally establishes persistence on the compromised developer or CI/CD host.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Upgrade OpenClaw to version 2026.2.22 or later — patch commit dd41fadcaf58fd9deb963d6e163c56161e7b35dd enforces absolute path matching in allowlist evaluation.
If immediate upgrade is blocked, disable 'ask=on-miss' to prevent silent approval of unresolved binaries, or switch to a deny-all security policy.
Audit all macOS hosts for OpenClaw deployments running with 'security=allowlist' in configuration; scan configuration files across developer workstations and CI/CD runners.
Monitor process trees spawned by OpenClaw for binaries resolved from relative paths or working directories.
Review CI/CD pipelines that invoke OpenClaw for untrusted content in working directories at execution time.
Rotate API keys, LLM tokens, and cloud credentials accessible from agent environments on affected hosts as a precaution pending confirmation of no prior exploitation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 2.4 - Residual risks and incidents

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32016?

OpenClaw, an AI agent execution framework, contains a path validation bypass in its exec-approval allowlist mode on macOS that allows a local attacker with low privileges to run arbitrary binaries by exploiting basename-only allowlist matching — placing a malicious binary named 'echo' in the working directory causes it to execute instead of the system's '/usr/bin/echo' without triggering an approval prompt. For security teams managing AI agent deployments, this is high-risk: AI coding assistants and autonomous agents routinely execute shell commands with broad permissions in environments containing API keys, cloud credentials, and LLM tokens, and this trivially-exploited bypass can be weaponized for credential theft or persistence on developer workstations and CI/CD runners. The EPSS score places this in the top 98th percentile for exploitation likelihood among similarly-scored CVEs, and the linked AIID incident #1368 confirms that OpenClaw's execution ecosystem is actively targeted by credential stealers — making this more than a theoretical risk. Patch to OpenClaw ≥ 2026.2.22 immediately; as an interim workaround, disable 'ask=on-miss' or move away from allowlist security mode, and rotate credentials accessible from affected agent environments.

Is CVE-2026-32016 actively exploited?

No confirmed active exploitation of CVE-2026-32016 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32016?

1. Upgrade OpenClaw to version 2026.2.22 or later — patch commit dd41fadcaf58fd9deb963d6e163c56161e7b35dd enforces absolute path matching in allowlist evaluation. 2. If immediate upgrade is blocked, disable 'ask=on-miss' to prevent silent approval of unresolved binaries, or switch to a deny-all security policy. 3. Audit all macOS hosts for OpenClaw deployments running with 'security=allowlist' in configuration; scan configuration files across developer workstations and CI/CD runners. 4. Monitor process trees spawned by OpenClaw for binaries resolved from relative paths or working directories. 5. Review CI/CD pipelines that invoke OpenClaw for untrusted content in working directories at execution time. 6. Rotate API keys, LLM tokens, and cloud credentials accessible from agent environments on affected hosts as a precaution pending confirmation of no prior exploitation.

What systems are affected by CVE-2026-32016?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agents, AI developer tooling, CI/CD AI pipelines.

What is the CVSS score for CVE-2026-32016?

CVE-2026-32016 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.12%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agentsAI developer toolingCI/CD AI pipelines

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to execute unauthorized binaries by exploiting basename-only allowlist entries. Attackers can execute same-name local binaries ./echo without approval when security=allowlist and ask=on-miss are configured, bypassing intended path-based policy restrictions.

Exploitation Scenario

An attacker with local access to a developer's macOS workstation — achievable via a malicious npm/pip package in the project, a compromised repository, or a drive-by infection — places a malicious Mach-O binary named 'echo' in the project's working directory. When the developer or an automated OpenClaw agent triggers a workflow invoking 'echo' (a utility almost certainly on any allowlist), OpenClaw's basename-only matching approves execution without a prompt. The malicious './echo' binary runs with the agent's permissions, harvests environment variables containing LLM API keys and cloud credentials, and exfiltrates them to an attacker-controlled endpoint — directly replicating the AMOS stealer credential-theft pattern documented in AIID incident #1368. On a CI/CD runner, the same attack surfaces repository secrets and deployment credentials.

Weaknesses (CWE)

CWE-426 Untrusted Search Path

CWE-426 — Untrusted Search Path: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.