CVE-2026-32022: OpenClaw grep safeBins bypass

CISO Take

OpenClaw's grep tool in its safeBins allowlist incorrectly assumes grep will only accept input from stdin; by passing a pattern via the -e flag and appending a positional filename operand, an attacker bypasses this restriction entirely and reads arbitrary files — including .env files containing API keys, database credentials, and model access tokens. Despite a CVSS of 6.5, the EPSS places this in the top 83rd percentile for exploitation likelihood, and the attack path is trivial for anyone who can influence agent inputs, whether through direct interaction or prompt injection via a poisoned data source. AI agent deployments are particularly exposed: agents routinely operate in directories where .env files live and may surface file contents in responses or downstream pipeline outputs. Upgrade to OpenClaw 2026.2.21 immediately; as an interim control, relocate credential files outside the agent working directory and audit safeBins tool configurations for similar stdin-bypass patterns.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS (6.5) materially understates operational risk in AI agent contexts. The vulnerability requires no special AI knowledge — once the bypass is understood, exploitation is a single grep invocation with a -e flag. The attack surface is broad: any deployment where an attacker influences agent inputs, including via prompt injection through RAG sources, malicious task parameters, or direct user interaction. Reading .env files in agentic environments routinely exposes LLM provider API keys, database passwords, and internal service tokens, enabling lateral movement well beyond the initial read. EPSS at the 83rd percentile signals the security community considers exploitation plausible near-term. No public exploit or CISA KEV entry as of publication, but the technique is elementary and the target data (credentials) is high-value.

How does the attack unfold?

Initial Access

Attacker gains the ability to influence OpenClaw agent inputs through direct user interaction, a prompt injection payload embedded in a retrieved document, or a poisoned RAG data source.

AML.T0051.001

Tool Policy Bypass

Attacker crafts input causing the agent to invoke grep with -e PATTERN .env, exploiting the positional filename operand to bypass the stdin-only safeBins restriction.

AML.T0053

Credential Harvest

The agent reads .env and other sensitive files from its working directory and surfaces their contents — exposing API keys, database passwords, and service tokens.

AML.T0083

Lateral Movement

Attacker uses harvested credentials to access LLM provider APIs, connected databases, and cloud infrastructure, cascading impact far beyond the initial file read.

AML.T0086

Initial Access

Attacker gains the ability to influence OpenClaw agent inputs through direct user interaction, a prompt injection payload embedded in a retrieved document, or a poisoned RAG data source.

AML.T0051.001

Tool Policy Bypass

Attacker crafts input causing the agent to invoke grep with -e PATTERN .env, exploiting the positional filename operand to bypass the stdin-only safeBins restriction.

AML.T0053

Credential Harvest

The agent reads .env and other sensitive files from its working directory and surfaces their contents — exposing API keys, database passwords, and service tokens.

AML.T0083

Lateral Movement

Attacker uses harvested credentials to access LLM provider APIs, connected databases, and cloud infrastructure, cascading impact far beyond the initial file read.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch immediately: upgrade to OpenClaw >= 2026.2.21, which enforces strict stdin-only input for grep with no positional filename operands.
If immediate patching is not possible: remove or relocate .env and other credential files outside the agent working directory; inject secrets via OS/container environment variables rather than file-based configs.
Apply least privilege: run the agent process under a restricted OS user with read permissions scoped to expected input paths only.
Detection: audit agent execution logs for grep invocations containing -e flags followed by positional file arguments; alert on grep calls accessing files outside designated input directories or reading dot-files.
Harden prompt injection surface: if the agent ingests external data (RAG sources, user documents, email), add input validation layers to block crafted tool-invocation payloads from propagating.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Data Leakage Agent Plugin AML.T0037 - Data from Local System AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.9.4 - Access control to AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of deployed AI

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32022?

OpenClaw's grep tool in its safeBins allowlist incorrectly assumes grep will only accept input from stdin; by passing a pattern via the -e flag and appending a positional filename operand, an attacker bypasses this restriction entirely and reads arbitrary files — including .env files containing API keys, database credentials, and model access tokens. Despite a CVSS of 6.5, the EPSS places this in the top 83rd percentile for exploitation likelihood, and the attack path is trivial for anyone who can influence agent inputs, whether through direct interaction or prompt injection via a poisoned data source. AI agent deployments are particularly exposed: agents routinely operate in directories where .env files live and may surface file contents in responses or downstream pipeline outputs. Upgrade to OpenClaw 2026.2.21 immediately; as an interim control, relocate credential files outside the agent working directory and audit safeBins tool configurations for similar stdin-bypass patterns.

Is CVE-2026-32022 actively exploited?

No confirmed active exploitation of CVE-2026-32022 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32022?

1. Patch immediately: upgrade to OpenClaw >= 2026.2.21, which enforces strict stdin-only input for grep with no positional filename operands. 2. If immediate patching is not possible: remove or relocate .env and other credential files outside the agent working directory; inject secrets via OS/container environment variables rather than file-based configs. 3. Apply least privilege: run the agent process under a restricted OS user with read permissions scoped to expected input paths only. 4. Detection: audit agent execution logs for grep invocations containing -e flags followed by positional file arguments; alert on grep calls accessing files outside designated input directories or reading dot-files. 5. Harden prompt injection surface: if the agent ingests external data (RAG sources, user documents, email), add input validation layers to block crafted tool-invocation payloads from propagating.

What systems are affected by CVE-2026-32022?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-agent pipelines, RAG pipelines, Agentic tool execution environments, LLM-powered automation workflows.

What is the CVSS score for CVE-2026-32022?

CVE-2026-32022 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-agent pipelinesRAG pipelinesAgentic tool execution environmentsLLM-powered automation workflows

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.9.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitrary files by supplying a pattern via the -e flag parameter. Attackers can include a positional filename operand to bypass file access restrictions and read sensitive files.env from the working directory.

Exploitation Scenario

An attacker interacts with an OpenClaw-based AI assistant — or injects a malicious instruction into a document the agent retrieves via a RAG pipeline. The crafted input instructs the agent to use its grep tool with the argument pattern grep -e '' .env, bypassing the stdin-only safeBins restriction via the positional filename operand. The agent reads the working directory's .env file and returns its contents in its response, exposing OPENAI_API_KEY, DATABASE_URL, STRIPE_SECRET_KEY, and similar secrets. The attacker immediately uses these credentials to access the LLM API (incurring cost and enabling prompt exfiltration), the backend database (data theft), and payment infrastructure. In a multi-agent orchestration setup, the same technique against an orchestrating agent exposes credentials shared across the entire pipeline.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.