CVE-2026-32026: OpenClaw sandbox path traversal

CISO Take

OpenClaw's sandbox media handler fails to validate that attachment paths stay within the sandbox root, allowing any authenticated low-privilege user to reference absolute paths under the host's /tmp directory and retrieve file contents via the normal attachment delivery response. EPSS places this in the top 74th percentile for exploitation likelihood, and the attack requires no user interaction — once valid credentials are obtained (a realistic bar given AIID #1368 shows credential theft via OpenClaw skills is an active threat), the file read is trivial. Temporary directories in AI agent deployments routinely hold cached API keys, LLM SDK session tokens, and inter-process inference artifacts, making host /tmp a more sensitive target than the CVSS 6.5 score implies. Upgrade to OpenClaw ≥ 2026.2.24 immediately using one of the three published patches; if patching is delayed, restrict network access to trusted principals and mount a dedicated, empty tmpfs for the OpenClaw container.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 6.5 Medium with elevated contextual risk in AI agent environments. The attack vector is network-accessible with low complexity, no user interaction, and only low-privilege credentials required — the minimum possible bar for an authenticated exploit. The high confidentiality impact (C:H) is realistic because /tmp in AI workloads frequently holds sensitive runtime artifacts. EPSS at top 74th percentile is notable for a CVE with no public PoC; threat actors already familiar with the OpenClaw ecosystem (per AIID #1368) have clear motive to use this path. No CISA KEV listing and only 4 downstream dependents limit blast radius, but any of those dependents serving multi-tenant AI workloads face cross-tenant data leakage risk.

How does the attack unfold?

Initial Access

Attacker authenticates to a network-accessible OpenClaw instance using low-privilege credentials obtained via credential theft from the ClawHub skill ecosystem or a phishing campaign targeting AI platform users.

AML.T0012

Exploitation

Attacker submits a media attachment reference crafted as an absolute path under /tmp (e.g., /tmp/openai_sdk_cache_a3f7b) that bypasses OpenClaw's flawed sandbox path validator, which incorrectly permits absolute paths rooted in the host temp directory.

AML.T0049

Sandbox Escape

OpenClaw reads the targeted file from the host /tmp directory outside the active sandbox root, exposing cached API keys, session tokens, or inter-agent communication artifacts stored there by co-located AI workloads.

AML.T0105

Exfiltration

The contents of the targeted host temp file are returned to the attacker in the normal attachment delivery response, completing exfiltration through the application's own legitimate channel.

AML.T0025

Initial Access

Attacker authenticates to a network-accessible OpenClaw instance using low-privilege credentials obtained via credential theft from the ClawHub skill ecosystem or a phishing campaign targeting AI platform users.

AML.T0012

Exploitation

Attacker submits a media attachment reference crafted as an absolute path under /tmp (e.g., /tmp/openai_sdk_cache_a3f7b) that bypasses OpenClaw's flawed sandbox path validator, which incorrectly permits absolute paths rooted in the host temp directory.

AML.T0049

Sandbox Escape

OpenClaw reads the targeted file from the host /tmp directory outside the active sandbox root, exposing cached API keys, session tokens, or inter-agent communication artifacts stored there by co-located AI workloads.

AML.T0105

Exfiltration

The contents of the targeted host temp file are returned to the attacker in the normal attachment delivery response, completing exfiltration through the application's own legitimate channel.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade to OpenClaw ≥ 2026.2.24 — apply commits d3da67c, 79a7b3d, def993d as published in the vendor advisory.
Detection: Query attachment delivery logs for media references containing absolute paths (/tmp/...) prior to patch date — any such entry is a confirmed exploitation attempt. Monitor OpenClaw process file-open syscalls against /tmp paths outside the expected sandbox directory.
Workaround if patching is delayed: Restrict OpenClaw API and UI to trusted IP ranges via firewall; disable attachment delivery features until patched.
Hardening: Run OpenClaw in an isolated container with /tmp bind-mounted from a dedicated, secret-free tmpfs — never share the host /tmp with the container.
Credential rotation: If OpenClaw has been accessible to untrusted users in the past 90 days, rotate any API keys, session tokens, or credentials that may have been written to /tmp by co-located AI workloads.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Data Leakage Agent Plugin AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 6.1.2 - AI risk assessment

NIST AI RMF

MEASURE 2.5 - AI system trustworthiness evaluation

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32026?

OpenClaw's sandbox media handler fails to validate that attachment paths stay within the sandbox root, allowing any authenticated low-privilege user to reference absolute paths under the host's /tmp directory and retrieve file contents via the normal attachment delivery response. EPSS places this in the top 74th percentile for exploitation likelihood, and the attack requires no user interaction — once valid credentials are obtained (a realistic bar given AIID #1368 shows credential theft via OpenClaw skills is an active threat), the file read is trivial. Temporary directories in AI agent deployments routinely hold cached API keys, LLM SDK session tokens, and inter-process inference artifacts, making host /tmp a more sensitive target than the CVSS 6.5 score implies. Upgrade to OpenClaw ≥ 2026.2.24 immediately using one of the three published patches; if patching is delayed, restrict network access to trusted principals and mount a dedicated, empty tmpfs for the OpenClaw container.

Is CVE-2026-32026 actively exploited?

No confirmed active exploitation of CVE-2026-32026 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32026?

1. Patch: Upgrade to OpenClaw ≥ 2026.2.24 — apply commits d3da67c, 79a7b3d, def993d as published in the vendor advisory. 2. Detection: Query attachment delivery logs for media references containing absolute paths (/tmp/...) prior to patch date — any such entry is a confirmed exploitation attempt. Monitor OpenClaw process file-open syscalls against /tmp paths outside the expected sandbox directory. 3. Workaround if patching is delayed: Restrict OpenClaw API and UI to trusted IP ranges via firewall; disable attachment delivery features until patched. 4. Hardening: Run OpenClaw in an isolated container with /tmp bind-mounted from a dedicated, secret-free tmpfs — never share the host /tmp with the container. 5. Credential rotation: If OpenClaw has been accessible to untrusted users in the past 90 days, rotate any API keys, session tokens, or credentials that may have been written to /tmp by co-located AI workloads.

What systems are affected by CVE-2026-32026?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, sandbox-isolated agent execution environments, multi-tenant AI agent deployments, media processing pipelines in AI agents, attachment delivery workflows in AI systems.

What is the CVSS score for CVE-2026-32026?

CVE-2026-32026 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworkssandbox-isolated agent execution environmentsmulti-tenant AI agent deploymentsmedia processing pipelines in AI agentsattachment delivery workflows in AI systems

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 6.1.2

NIST AI RMF: MEASURE 2.5

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary directory outside the active sandbox root. Attackers can exploit this by providing malicious media references to read and exfiltrate arbitrary files from the host temporary directory through attachment delivery mechanisms.

Exploitation Scenario

An attacker who has obtained a low-privilege OpenClaw account — plausible via credential theft from the ClawHub skill ecosystem (see AIID #1368) or through a phishing campaign targeting AI platform users — submits a media attachment with a reference crafted as an absolute path: e.g., /tmp/openai_sdk_cache_a3f7b or /tmp/agent_session_8821.json. Because the path validation logic incorrectly permits absolute paths that begin with the host /tmp root even when they fall outside the active sandbox root, OpenClaw reads the target file and delivers its contents in the attachment response. The attacker parses the response to extract cached API credentials or session tokens, then pivots to authenticate directly against downstream AI APIs or other internal services. In a shared deployment, the same technique retrieves a co-located user's session data, enabling cross-tenant impersonation.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.