CVE-2026-32024: OpenClaw symlink traversal leaks

CISO Take

OpenClaw versions before 2026.2.22 allow any low-privileged local attacker to read arbitrary files outside the agent's configured workspace by placing symlinks in the avatar storage directory and retrieving them through the gateway surface. While the local attack vector (AV:L) limits remote mass exploitation, AI agent deployments routinely run on shared infrastructure where multiple users or processes coexist, and the EPSS score places this in the top 76th percentile of likely-to-be-exploited vulnerabilities. The primary concern for CISOs is confidentiality impact rated HIGH: a successful traversal can expose .env files, API keys, model credentials, or system secrets that the OpenClaw process has read access to, effectively turning a medium-CVSS file-read into a credential-compromise stepping stone. The package also carries 396 prior CVEs, signaling a historically weak security posture. Patch immediately to 2026.2.22 or later; if patching is blocked, restrict the OpenClaw process to a dedicated low-privilege service account with a tightly scoped filesystem view and monitor avatar storage directories for unexpected symlink creation.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Contextual risk is elevated above the raw CVSS 5.5 for AI agent deployments. OpenClaw agents commonly run with access to credential files, API tokens, and model configuration that a generic application would not hold. The AV:L constraint is partially offset in containerized or cloud-VM environments where lateral movement from another process is routine. No public exploit or Nuclei template exists yet, and KEV is negative, suggesting active exploitation is not confirmed. However, EPSS top-76 percentile and the historical vulnerability density of this package (396 CVEs) increases probability of near-term exploitation. Net: HIGH contextual risk for organizations running OpenClaw in multi-tenant or shared-infra environments, MEDIUM for isolated single-tenant deployments.

How does the attack unfold?

Initial Access

Attacker obtains low-privileged local execution on the host running OpenClaw, either via lateral movement, a compromised CI/CD job, or a separate vulnerability.

AML.T0012

Symlink Placement

Attacker creates a symbolic link inside OpenClaw's avatar storage directory pointing to a high-value target file (e.g., .env, credentials.json) outside the workspace boundary.

AML.T0037

Traversal Trigger

Attacker requests the crafted avatar resource through the OpenClaw gateway; the server follows the symlink without validation and reads the target file contents.

AML.T0049

Credential Exfiltration

Sensitive file contents (API keys, database passwords, model credentials) are returned in the HTTP response and collected by the attacker for downstream privilege escalation or API abuse.

AML.T0025

Initial Access

Attacker obtains low-privileged local execution on the host running OpenClaw, either via lateral movement, a compromised CI/CD job, or a separate vulnerability.

AML.T0012

Symlink Placement

Attacker creates a symbolic link inside OpenClaw's avatar storage directory pointing to a high-value target file (e.g., .env, credentials.json) outside the workspace boundary.

AML.T0037

Traversal Trigger

Attacker requests the crafted avatar resource through the OpenClaw gateway; the server follows the symlink without validation and reads the target file contents.

AML.T0049

Credential Exfiltration

Sensitive file contents (API keys, database passwords, model credentials) are returned in the HTTP response and collected by the attacker for downstream privilege escalation or API abuse.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to >= 2026.2.22 immediately (commits 3d03375 and 6970c2c address the symlink resolution).
Isolate: Run the OpenClaw process under a dedicated service account with filesystem access limited to its workspace via AppArmor, SELinux, or seccomp profiles — this degrades the traversal's blast radius even on unpatched versions.
Harden avatar storage: Set the avatar upload/storage directory to a dedicated partition or tmpfs mount with no sensitive files reachable via symlink; periodically audit for unexpected symlinks (find <avatar-dir> -type l).
Detect: Alert on symlink creation inside OpenClaw workspace directories using inotifywait or auditd rules on OPEN_NOFOLLOW violations.
Review downstream dependents: Audit the 4 packages depending on OpenClaw and confirm they pin to a patched version.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Privacy Violation Agent AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.8.2 - AI system access control

NIST AI RMF

MANAGE-2.2 - Mechanisms are in place to respond to residual risks

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32024?

OpenClaw versions before 2026.2.22 allow any low-privileged local attacker to read arbitrary files outside the agent's configured workspace by placing symlinks in the avatar storage directory and retrieving them through the gateway surface. While the local attack vector (AV:L) limits remote mass exploitation, AI agent deployments routinely run on shared infrastructure where multiple users or processes coexist, and the EPSS score places this in the top 76th percentile of likely-to-be-exploited vulnerabilities. The primary concern for CISOs is confidentiality impact rated HIGH: a successful traversal can expose .env files, API keys, model credentials, or system secrets that the OpenClaw process has read access to, effectively turning a medium-CVSS file-read into a credential-compromise stepping stone. The package also carries 396 prior CVEs, signaling a historically weak security posture. Patch immediately to 2026.2.22 or later; if patching is blocked, restrict the OpenClaw process to a dedicated low-privilege service account with a tightly scoped filesystem view and monitor avatar storage directories for unexpected symlink creation.

Is CVE-2026-32024 actively exploited?

No confirmed active exploitation of CVE-2026-32024 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32024?

1. Patch: Upgrade OpenClaw to >= 2026.2.22 immediately (commits 3d03375 and 6970c2c address the symlink resolution). 2. Isolate: Run the OpenClaw process under a dedicated service account with filesystem access limited to its workspace via AppArmor, SELinux, or seccomp profiles — this degrades the traversal's blast radius even on unpatched versions. 3. Harden avatar storage: Set the avatar upload/storage directory to a dedicated partition or tmpfs mount with no sensitive files reachable via symlink; periodically audit for unexpected symlinks (find <avatar-dir> -type l). 4. Detect: Alert on symlink creation inside OpenClaw workspace directories using inotifywait or auditd rules on OPEN_NOFOLLOW violations. 5. Review downstream dependents: Audit the 4 packages depending on OpenClaw and confirm they pin to a patched version.

What systems are affected by CVE-2026-32024?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, agentic pipelines with shared filesystem.

What is the CVSS score for CVE-2026-32024?

CVE-2026-32024 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingagentic pipelines with shared filesystem

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.8.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace boundary. Remote attackers can exploit this by requesting avatar resources through gateway surfaces to disclose local files accessible to the OpenClaw process.

Exploitation Scenario

An adversary with a shell on the host — gained, for example, via a compromised CI/CD pipeline or a separate low-severity vuln — creates a symlink inside OpenClaw's avatar storage directory: ln -s /opt/aithreatintel/.env /opt/openclaw/avatars/user123.png. They then issue a request to the OpenClaw gateway requesting that avatar resource (GET /avatars/user123). The gateway follows the symlink, reads the .env file, and returns its contents in the HTTP response. The attacker extracts LLM API keys, database credentials, or Stripe/Resend secrets stored in that file, and pivots to direct API abuse or further infrastructure compromise — all without triggering the application's authentication layer because avatar serving is typically unauthenticated.

Weaknesses (CWE)

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.