CVE-2026-32020: OpenClaw symlink traversal enables

CISO Take

OpenClaw prior to version 2026.2.22 contains a path traversal flaw in its static file handler that follows symbolic links without directory confinement checks, allowing any local user with low privileges to read arbitrary files outside the Control UI root. Despite a low CVSS of 3.3, the EPSS metric places this vulnerability in the top 97th percentile for exploitation likelihood — a divergence that signals active adversary interest, corroborated by AIID #1368 where malicious OpenClaw skills were weaponized to steal credentials via the ClawHub marketplace in early 2026. In AI agent deployments, arbitrary local file reads are disproportionately dangerous because configuration files routinely co-locate LLM API keys, system prompts, and tool definitions that unlock deeper infrastructure compromise. Patch to 2026.2.22 immediately (commit 7c500ff); if patching is not feasible, restrict write access to the Control UI root and audit it for unauthorized symlinks with `find <ui_root> -type l -print`.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Rated CVSS 3.3 (Low) due to local attack vector and limited confidentiality impact, but operational context elevates actual risk materially. EPSS 97th percentile signals demonstrated attacker scanning and exploitation interest disproportionate to the base score. In AI agent environments, configuration files co-located with or accessible from the web root routinely hold LLM API credentials, tool tokens, and agent definitions — making a low-CVSS file-read vulnerability a credible stepping stone to full agent compromise. The OpenClaw skills ecosystem (AIID #1368) provides a plausible delivery vector for obtaining local execution, converting a nominally low-severity finding into a meaningful supply chain risk for organizations consuming third-party ClawHub skills.

How does the attack unfold?

Initial Access via Malicious Skill

Adversary publishes or installs a malicious OpenClaw skill via ClawHub that executes with local user privileges on the host running the agent.

AML.T0010.005

Symlink Placement

The malicious skill or low-privileged local user creates a symbolic link inside the Control UI root directory pointing to a sensitive target file such as .env, SSH private keys, or /etc/shadow.

AML.T0037

Arbitrary File Read via Traversal

OpenClaw's static file handler follows the symlink without verifying the resolved path against the intended root, returning target file contents to the HTTP requester.

Credential Exfiltration and Pivot

Attacker obtains LLM API keys, tool integration credentials, or system secrets from the read file and uses them to pivot into connected AI infrastructure or external services.

AML.T0083

Initial Access via Malicious Skill

Adversary publishes or installs a malicious OpenClaw skill via ClawHub that executes with local user privileges on the host running the agent.

AML.T0010.005

Symlink Placement

The malicious skill or low-privileged local user creates a symbolic link inside the Control UI root directory pointing to a sensitive target file such as .env, SSH private keys, or /etc/shadow.

AML.T0037

Arbitrary File Read via Traversal

OpenClaw's static file handler follows the symlink without verifying the resolved path against the intended root, returning target file contents to the HTTP requester.

Credential Exfiltration and Pivot

Attacker obtains LLM API keys, tool integration credentials, or system secrets from the read file and uses them to pivot into connected AI infrastructure or external services.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

3.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

5 steps

Upgrade OpenClaw to version 2026.2.22 or later — patch commit 7c500ff is publicly available and resolves the symlink-following defect in the static handler.
If immediate patching is not possible, restrict write permissions on the Control UI root directory to trusted system accounts only, eliminating the ability for unprivileged users or installed skills to plant symlinks.
Audit existing deployments for unauthorized symbolic links: find <ui_root> -type l -print.
Review all installed third-party skills for unexpected filesystem operations; treat any skill requesting write access to web-accessible directories as high-risk.
As a precautionary measure, rotate any API keys or secrets stored in files accessible from the Control UI root, particularly LLM provider keys and tool integration credentials.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Supply Chain Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0037 - Data from Local System AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2 - AI system design and development

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of deployed AI are evaluated and applied

OWASP LLM Top 10

LLM03 - Supply Chain LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-32020?

OpenClaw prior to version 2026.2.22 contains a path traversal flaw in its static file handler that follows symbolic links without directory confinement checks, allowing any local user with low privileges to read arbitrary files outside the Control UI root. Despite a low CVSS of 3.3, the EPSS metric places this vulnerability in the top 97th percentile for exploitation likelihood — a divergence that signals active adversary interest, corroborated by AIID #1368 where malicious OpenClaw skills were weaponized to steal credentials via the ClawHub marketplace in early 2026. In AI agent deployments, arbitrary local file reads are disproportionately dangerous because configuration files routinely co-locate LLM API keys, system prompts, and tool definitions that unlock deeper infrastructure compromise. Patch to 2026.2.22 immediately (commit 7c500ff); if patching is not feasible, restrict write access to the Control UI root and audit it for unauthorized symlinks with `find <ui_root> -type l -print`.

Is CVE-2026-32020 actively exploited?

No confirmed active exploitation of CVE-2026-32020 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32020?

1. Upgrade OpenClaw to version 2026.2.22 or later — patch commit 7c500ff is publicly available and resolves the symlink-following defect in the static handler. 2. If immediate patching is not possible, restrict write permissions on the Control UI root directory to trusted system accounts only, eliminating the ability for unprivileged users or installed skills to plant symlinks. 3. Audit existing deployments for unauthorized symbolic links: `find <ui_root> -type l -print`. 4. Review all installed third-party skills for unexpected filesystem operations; treat any skill requesting write access to web-accessible directories as high-risk. 5. As a precautionary measure, rotate any API keys or secrets stored in files accessible from the Control UI root, particularly LLM provider keys and tool integration credentials.

What systems are affected by CVE-2026-32020?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, AI agent configuration stores, AI skill/plugin ecosystems.

What is the CVSS score for CVE-2026-32020?

CVE-2026-32020 has a CVSS v3.1 base score of 3.3 (LOW). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsAI agent configuration storesAI skill/plugin ecosystems

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0037 Data from Local System

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads. Attackers can place symlinks under the Control UI root directory to bypass directory confinement checks and read arbitrary files outside the intended root.

Exploitation Scenario

An adversary who has installed a malicious skill via OpenClaw's ClawHub marketplace — or who has obtained low-privileged local shell access — navigates to the Control UI root directory and creates a symbolic link pointing to a sensitive target: `ln -s /opt/openclaw/.env credentials.txt`. When the static file handler receives an HTTP request for `credentials.txt`, it follows the symlink without verifying the resolved path against the intended root, and returns the contents of .env to the caller. The file typically contains the OpenClaw LLM API key, tool integration tokens (e.g., search, calendar, email), and database connection strings. The attacker exfiltrates these credentials to pivot into the broader AI agent infrastructure, replicating the AIID #1368 AMOS stealer credential-theft pattern via a filesystem vector rather than process injection.

Weaknesses (CWE)

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.