CVE-2026-32030: OpenClaw path traversal exposes host

CISO Take

OpenClaw versions prior to 2026.2.19 contain a path traversal flaw (CWE-22) in the stageSandboxMedia function that allows an attacker to read arbitrary files accessible to the OpenClaw process on the configured remote host via SCP — no authentication, no prior access, and no user interaction required. Any deployment with iMessage remote attachment fetching enabled is reachable at the network level, meaning a single crafted iMessage with manipulated attachment path metadata triggers file disclosure. The EPSS score places this at the 74th percentile for exploitation likelihood, and the OpenClaw ecosystem has a documented history of active abuse for credential exfiltration (AIID #1368), making affected hosts high-value targets for financially motivated actors. Patch to 2026.2.19 immediately; as an interim measure, disable iMessage remote attachment fetching and audit SCP transfer logs for reads to paths outside expected media directories.

Sources: NVD EPSS GitHub Advisory ATLAS vulncheck.com

What is the risk?

High risk for AI agent deployments running OpenClaw with iMessage integration enabled. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) represents the most dangerous exploitability profile: fully network-reachable, no special conditions, zero credentials required. Although no public exploit code or active CISA KEV listing exists today, the AI agent category amplifies blast radius significantly — OpenClaw processes typically hold broad filesystem permissions to support agentic tasks, meaning a successful path traversal can expose LLM provider API keys, SSH keys, RAG database credentials, and model artifacts in a single request. The 74th EPSS percentile and a package history of 396 CVEs indicate a well-targeted attack surface.

How does the attack unfold?

Initial Access

Attacker crafts an iMessage with manipulated attachment path metadata pointing to a sensitive file on the OpenClaw host (e.g., /home/openclaw/.env or ~/.ssh/id_rsa) and delivers it to a target with iMessage attachment fetching enabled.

AML.T0049

Exploitation

OpenClaw calls stageSandboxMedia with the attacker-controlled absolute path without validating or sanitizing it, triggering the CWE-22 path traversal vulnerability and bypassing sandbox boundaries.

AML.T0053

Collection

The OpenClaw process reads the target file from the local host filesystem using the traversed path, gaining access to credentials, API keys, or other sensitive AI pipeline artifacts in plaintext.

AML.T0037

Exfiltration

The file contents are transferred via SCP to the attacker-controlled remote staging host, completing silent data exfiltration with no victim-side alerting or logging of the unauthorized read.

AML.T0086

Initial Access

Attacker crafts an iMessage with manipulated attachment path metadata pointing to a sensitive file on the OpenClaw host (e.g., /home/openclaw/.env or ~/.ssh/id_rsa) and delivers it to a target with iMessage attachment fetching enabled.

AML.T0049

Exploitation

OpenClaw calls stageSandboxMedia with the attacker-controlled absolute path without validating or sanitizing it, triggering the CWE-22 path traversal vulnerability and bypassing sandbox boundaries.

AML.T0053

Collection

The OpenClaw process reads the target file from the local host filesystem using the traversed path, gaining access to credentials, API keys, or other sensitive AI pipeline artifacts in plaintext.

AML.T0037

Exfiltration

The file contents are transferred via SCP to the attacker-controlled remote staging host, completing silent data exfiltration with no victim-side alerting or logging of the unauthorized read.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.2.19 or later (commit 1316e57 closes the path validation gap in stageSandboxMedia).
Workaround: Disable iMessage remote attachment fetching in OpenClaw configuration if patching cannot be done immediately — this eliminates the attack surface entirely.
Detection: Audit SCP transfer logs on OpenClaw hosts for file reads outside expected media directories; flag requests targeting /etc/, ~/.ssh/, .env files, *.key, and AI service configuration paths.
Hardening: Run OpenClaw under a dedicated low-privilege OS account with filesystem access scoped to required directories via AppArmor, SELinux, or strict POSIX permissions.
Inventory: Enumerate all OpenClaw instances with iMessage integration enabled and prioritize patch deployment by network exposure.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Data Leakage Agent AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system input data

NIST AI RMF

MEASURE 2.5 - AI risks and impacts are evaluated for the AI system

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32030?

OpenClaw versions prior to 2026.2.19 contain a path traversal flaw (CWE-22) in the stageSandboxMedia function that allows an attacker to read arbitrary files accessible to the OpenClaw process on the configured remote host via SCP — no authentication, no prior access, and no user interaction required. Any deployment with iMessage remote attachment fetching enabled is reachable at the network level, meaning a single crafted iMessage with manipulated attachment path metadata triggers file disclosure. The EPSS score places this at the 74th percentile for exploitation likelihood, and the OpenClaw ecosystem has a documented history of active abuse for credential exfiltration (AIID #1368), making affected hosts high-value targets for financially motivated actors. Patch to 2026.2.19 immediately; as an interim measure, disable iMessage remote attachment fetching and audit SCP transfer logs for reads to paths outside expected media directories.

Is CVE-2026-32030 actively exploited?

No confirmed active exploitation of CVE-2026-32030 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32030?

1. Patch: Upgrade OpenClaw to 2026.2.19 or later (commit 1316e57 closes the path validation gap in stageSandboxMedia). 2. Workaround: Disable iMessage remote attachment fetching in OpenClaw configuration if patching cannot be done immediately — this eliminates the attack surface entirely. 3. Detection: Audit SCP transfer logs on OpenClaw hosts for file reads outside expected media directories; flag requests targeting /etc/, ~/.ssh/, .env files, *.key, and AI service configuration paths. 4. Hardening: Run OpenClaw under a dedicated low-privilege OS account with filesystem access scoped to required directories via AppArmor, SELinux, or strict POSIX permissions. 5. Inventory: Enumerate all OpenClaw instances with iMessage integration enabled and prioritize patch deployment by network exposure.

What systems are affected by CVE-2026-32030?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI assistant deployments with messaging integrations, agentic pipelines with remote file staging.

What is the CVSS score for CVE-2026-32030?

CVE-2026-32030 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI assistant deployments with messaging integrationsagentic pipelines with remote file staging

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.5

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessage remote attachment fetching is enabled. An attacker who can tamper with attachment path metadata can disclose files readable by the OpenClaw process on the configured remote host via SCP.

Exploitation Scenario

An attacker who controls or can tamper with iMessage attachment metadata — via a compromised sender account, a relay injection point, or a separate vulnerability in the iMessage delivery chain — crafts an attachment record with a path value pointing to a sensitive file on the OpenClaw host (e.g., /home/openclaw/.env containing LLM API keys, or ~/.ssh/id_rsa). When OpenClaw processes the incoming message and calls stageSandboxMedia, it accepts the absolute path without sanitization and initiates an SCP transfer of that file to the configured remote staging host. The file arrives at the attacker-controlled endpoint with no alert generated on the victim side, yielding plaintext credentials or key material for follow-on compromise of connected AI services.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.