CVE-2026-32032: OpenClaw SHELL env var injection

CISO Take

OpenClaw, an AI agent framework, fails to validate the SHELL environment variable before spawning shell processes, allowing any local user with low privileges to execute arbitrary commands at the process's privilege level — a classic CWE-426 (Untrusted Search Path) flaw requiring zero exploit tooling. Despite a low absolute EPSS of 0.00127, this vulnerability ranks in the top 97th percentile for exploitation likelihood, and active adversarial interest in the OpenClaw ecosystem is confirmed by the AIID #1368 malicious-skills campaign that delivered credential-stealing malware (AMOS stealer) to affected hosts. AI agent pipelines and CI/CD runners are the highest-risk targets, as OpenClaw processes frequently hold LLM API keys, database credentials, and production infrastructure access that a successful exploit immediately exposes. Teams running pre-2026.2.22 versions should upgrade immediately; as an interim control, sanitize or explicitly set SHELL to a trusted path in any process launch wrapper and audit environment variable isolation across all OpenClaw deployments.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High practical risk despite local-only attack vector. The combination of trivial exploitation (AC:Low, PR:Low, no public exploit tooling needed), 97th-percentile exploitation likelihood, and the AI agent execution context — where OpenClaw processes routinely hold privileged credentials and pipeline access — elevates real-world risk well above what the CVSS 7.8 score alone conveys. The 396 prior CVEs in this package and active malicious actor interest documented in AIID #1368 further support treating this as an urgent patch priority.

How does the attack unfold?

Local Access

Attacker obtains low-privilege local access to a host running OpenClaw via a compromised CI/CD runner account, shared development environment, or lateral movement from another compromised system.

AML.T0012

Environment Manipulation

Attacker exports SHELL to a malicious binary or script path (e.g., export SHELL=/tmp/.implant) prior to OpenClaw process launch, substituting the trusted shell interpreter with an attacker-controlled payload.

AML.T0081

Shell Injection Execution

OpenClaw's shell fallback logic reads the unvalidated SHELL variable and invokes the malicious binary with OpenClaw process privileges, achieving arbitrary code execution via CWE-426 (Untrusted Search Path).

AML.T0050

Credential Exfiltration

Malicious payload harvests LLM API keys, database credentials, and service tokens from the agent's environment and configuration files, enabling follow-on compromise of connected AI infrastructure.

AML.T0083

Local Access

Attacker obtains low-privilege local access to a host running OpenClaw via a compromised CI/CD runner account, shared development environment, or lateral movement from another compromised system.

AML.T0012

Environment Manipulation

Attacker exports SHELL to a malicious binary or script path (e.g., export SHELL=/tmp/.implant) prior to OpenClaw process launch, substituting the trusted shell interpreter with an attacker-controlled payload.

AML.T0081

Shell Injection Execution

OpenClaw's shell fallback logic reads the unvalidated SHELL variable and invokes the malicious binary with OpenClaw process privileges, achieving arbitrary code execution via CWE-426 (Untrusted Search Path).

AML.T0050

Credential Exfiltration

Malicious payload harvests LLM API keys, database credentials, and service tokens from the agent's environment and configuration files, enabling follow-on compromise of connected AI infrastructure.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.2.22 or later (patch commit 25e89cc86338ef475d26be043aa541dfdb95e52a references the fix).
Workaround: Sanitize or explicitly override the SHELL environment variable to a trusted path (e.g., SHELL=/bin/bash) before launching any OpenClaw process in scripts, containers, or CI/CD runners.
Containment: Run OpenClaw in minimal-privilege containers with restricted, read-only environment variable sets; strip non-essential variables at container entrypoint.
Detection: Monitor process trees for unexpected child process spawning from OpenClaw — anomalous shell invocations or unusual binary paths as child processes are the key signal. Use EDR telemetry to flag SHELL path substitutions.
Audit: Review all CI/CD pipelines and automation that launch OpenClaw to verify environment variable isolation and confirm no shared-user contexts exist on hosts running OpenClaw.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.4 - AI system implementation

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to monitor the effectiveness of AI risk mitigation

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32032?

OpenClaw, an AI agent framework, fails to validate the SHELL environment variable before spawning shell processes, allowing any local user with low privileges to execute arbitrary commands at the process's privilege level — a classic CWE-426 (Untrusted Search Path) flaw requiring zero exploit tooling. Despite a low absolute EPSS of 0.00127, this vulnerability ranks in the top 97th percentile for exploitation likelihood, and active adversarial interest in the OpenClaw ecosystem is confirmed by the AIID #1368 malicious-skills campaign that delivered credential-stealing malware (AMOS stealer) to affected hosts. AI agent pipelines and CI/CD runners are the highest-risk targets, as OpenClaw processes frequently hold LLM API keys, database credentials, and production infrastructure access that a successful exploit immediately exposes. Teams running pre-2026.2.22 versions should upgrade immediately; as an interim control, sanitize or explicitly set SHELL to a trusted path in any process launch wrapper and audit environment variable isolation across all OpenClaw deployments.

Is CVE-2026-32032 actively exploited?

No confirmed active exploitation of CVE-2026-32032 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32032?

1. Patch: Upgrade OpenClaw to version 2026.2.22 or later (patch commit 25e89cc86338ef475d26be043aa541dfdb95e52a references the fix). 2. Workaround: Sanitize or explicitly override the SHELL environment variable to a trusted path (e.g., SHELL=/bin/bash) before launching any OpenClaw process in scripts, containers, or CI/CD runners. 3. Containment: Run OpenClaw in minimal-privilege containers with restricted, read-only environment variable sets; strip non-essential variables at container entrypoint. 4. Detection: Monitor process trees for unexpected child process spawning from OpenClaw — anomalous shell invocations or unusual binary paths as child processes are the key signal. Use EDR telemetry to flag SHELL path substitutions. 5. Audit: Review all CI/CD pipelines and automation that launch OpenClaw to verify environment variable isolation and confirm no shared-user contexts exist on hosts running OpenClaw.

What systems are affected by CVE-2026-32032?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CI/CD pipelines for AI, multi-agent orchestration, model serving infrastructure.

What is the CVSS score for CVE-2026-32032?

CVE-2026-32032 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworksCI/CD pipelines for AImulti-agent orchestrationmodel serving infrastructure

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands with the privileges of the OpenClaw process.

Exploitation Scenario

An attacker with low-privilege local access to a CI/CD runner — via a compromised developer account or shared build environment — exports SHELL=/tmp/.implant, where the malicious binary silently exfiltrates LLM API keys, Stripe credentials, and database URLs present in the runner's environment to an attacker-controlled endpoint. When the pipeline triggers an OpenClaw agent task, OpenClaw's shell fallback logic reads the unvalidated SHELL variable and executes the payload with the permissions of the OpenClaw process. The attacker receives credentials out-of-band and pivots to production AI infrastructure, consistent with the credential exfiltration pattern documented in AIID #1368 where OpenClaw's third-party skills ecosystem was weaponized for the same outcome.

Weaknesses (CWE)

CWE-426 Untrusted Search Path

CWE-426 — Untrusted Search Path: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.