CVE-2026-32017: OpenClaw allowlist bypass enables

CISO Take

OpenClaw's safeBins exec policy can be bypassed by any low-privileged, network-reachable attacker who appends short options (e.g., -o) to whitelisted binaries, achieving arbitrary file writes on the host without user interaction. Although not in CISA KEV and no public exploit exists today, the vulnerability sits in the top 83rd EPSS percentile, and the same package carries 396 tracked CVEs—a pattern of structural security debt that warrants heightened concern. In AI agent deployments where OpenClaw processes run with filesystem access and often elevated permissions, an arbitrary file write translates directly to agent configuration tampering, tool definition poisoning, or backdoor planting in execution paths. Upgrade to OpenClaw 2026.2.19 immediately and audit safeBins allowlists for binaries that accept output-redirection short options.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High risk for organizations running AI agent workloads with OpenClaw. The attack requires only low privileges over the network with no user interaction and low complexity, making it accessible to a broad range of threat actors. While no active exploitation evidence exists, the 83rd EPSS percentile signals above-average near-term exploitation likelihood for a vulnerability published just months ago. The integrity-only CVSS impact is partially offset by the severe downstream consequences of file-write primitives in agentic environments, where agent configs, tool definitions, and execution scripts are high-value persistence targets. Four downstream dependents extend exposure beyond direct OpenClaw consumers.

How does the attack unfold?

Initial Access

Attacker authenticates to OpenClaw with low-privilege credentials or hijacks an existing agent session via prompt injection targeting the exec interface.

AML.T0012

Policy Discovery

Attacker enumerates the safeBins allowlist to identify whitelisted binaries that accept output-redirection short options (e.g., curl -o, wget -O).

AML.T0084.001

Allowlist Bypass

Attacker invokes a whitelisted binary through OpenClaw's exec interface with a short-option payload (e.g., -o <target_path>), bypassing argument validation due to CWE-184.

AML.T0053

Persistence & Impact

Arbitrary file written to a high-value path (agent tool directory, config file, or execution script), enabling persistent backdoor execution or configuration poisoning on subsequent agent invocations.

AML.T0081

Initial Access

Attacker authenticates to OpenClaw with low-privilege credentials or hijacks an existing agent session via prompt injection targeting the exec interface.

AML.T0012

Policy Discovery

Attacker enumerates the safeBins allowlist to identify whitelisted binaries that accept output-redirection short options (e.g., curl -o, wget -O).

AML.T0084.001

Allowlist Bypass

Attacker invokes a whitelisted binary through OpenClaw's exec interface with a short-option payload (e.g., -o <target_path>), bypassing argument validation due to CWE-184.

AML.T0053

Persistence & Impact

Arbitrary file written to a high-value path (agent tool directory, config file, or execution script), enabling persistent backdoor execution or configuration poisoning on subsequent agent invocations.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

Upgrade OpenClaw to version 2026.2.19 or later per the vendor advisory (commits cfe8457, bafdbb6, fec48a5 apply the fix).
Audit all safeBins allowlist entries for binaries that accept output-redirection or file-write short options (e.g., -o, -f, -w, --output); remove or restrict these entries pending patch deployment.
Apply least-privilege filesystem permissions to OpenClaw agent processes—restrict write access to only directories explicitly required for agent operation.
Deploy file-integrity monitoring (e.g., auditd, Falco) on directories accessible by OpenClaw processes to detect unexpected file creation events.
Review agent execution logs for invocations of whitelisted binaries with appended short options as an indicator of exploit attempts or ongoing abuse.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2.3 - AI system input controls

NIST AI RMF

MANAGE 2.4 - Residual risks and impacts

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32017?

OpenClaw's safeBins exec policy can be bypassed by any low-privileged, network-reachable attacker who appends short options (e.g., -o) to whitelisted binaries, achieving arbitrary file writes on the host without user interaction. Although not in CISA KEV and no public exploit exists today, the vulnerability sits in the top 83rd EPSS percentile, and the same package carries 396 tracked CVEs—a pattern of structural security debt that warrants heightened concern. In AI agent deployments where OpenClaw processes run with filesystem access and often elevated permissions, an arbitrary file write translates directly to agent configuration tampering, tool definition poisoning, or backdoor planting in execution paths. Upgrade to OpenClaw 2026.2.19 immediately and audit safeBins allowlists for binaries that accept output-redirection short options.

Is CVE-2026-32017 actively exploited?

No confirmed active exploitation of CVE-2026-32017 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32017?

1. Upgrade OpenClaw to version 2026.2.19 or later per the vendor advisory (commits cfe8457, bafdbb6, fec48a5 apply the fix). 2. Audit all safeBins allowlist entries for binaries that accept output-redirection or file-write short options (e.g., -o, -f, -w, --output); remove or restrict these entries pending patch deployment. 3. Apply least-privilege filesystem permissions to OpenClaw agent processes—restrict write access to only directories explicitly required for agent operation. 4. Deploy file-integrity monitoring (e.g., auditd, Falco) on directories accessible by OpenClaw processes to detect unexpected file creation events. 5. Review agent execution logs for invocations of whitelisted binaries with appended short options as an indicator of exploit attempts or ongoing abuse.

What systems are affected by CVE-2026-32017?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, tool execution environments, AI agent pipelines, model serving with agent sidecars.

What is the CVSS score for CVE-2026-32017?

CVE-2026-32017 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstool execution environmentsAI agent pipelinesmodel serving with agent sidecars

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using short-option payloads. Attackers can bypass argument validation by attaching short options like -o to whitelisted binaries, enabling unauthorized file-write operations that should be denied by safeBins checks.

Exploitation Scenario

An adversary with a low-privileged account—or co-opting an agent session via prompt injection—identifies that a binary such as curl or wget appears in OpenClaw's safeBins allowlist. They invoke the binary through OpenClaw's exec interface, appending a short option like -o /opt/openclaw/tools/malicious_tool.py pointed at an attacker-controlled output URL. Because argument validation checks only the binary name against the allowlist and fails to inspect short-option payloads (CWE-184), the file write succeeds. The attacker plants a malicious tool definition that executes on the next agent invocation, achieving persistent code execution under the agent's identity. From this foothold, credentials in agent configuration files can be harvested, the agent's RAG index poisoned, or connected services compromised—mirroring the AMOS Stealer delivery path documented in AIID #1368.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.