CVE-2026-32043: OpenClaw TOCTOU symlink bypasses

CISO Take

CVE-2026-32043 is a time-of-check-time-of-use race condition in OpenClaw's system.run function where the working directory parameter is validated at approval time but resolved at execution, allowing an attacker to swap a symlink in the window between the two events and execute commands in an unauthorized directory context. Despite a Medium CVSS of 6.5, the EPSS percentile places this in the top 1% of CVEs by exploitation likelihood, and critically, the OpenClaw ecosystem is already implicated in active credential-stealing campaigns via malicious third-party skills (AIID #1368) — meaning the threat actor population targeting this platform is real and motivated. The outsized concern for CISOs is that this exploit dismantles the human-in-the-loop approval guardrail directly, not through code execution trickery but through a logic bypass against the agent's primary safety control, leaving any host where OpenClaw agents hold elevated OS privileges at risk of persistent node compromise. Upgrade to OpenClaw 2026.2.25 or later (patch commit f789f880); as an interim control, apply mount namespace or AppArmor confinement to agent working directories to prevent symlink redirection outside approved paths.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Operational risk meaningfully exceeds what the Medium CVSS (6.5) conveys for AI agent deployments. This vulnerability targets the approval mechanism — the primary safety guardrail for agent-executed system commands — via a logic bypass rather than memory corruption, meaning standard memory-protection mitigations provide no defense. High attack complexity reflects race condition timing, but approval-window races are reliably triggerable in practice with simple scripting or inotify-based tooling. Any host where OpenClaw agents run under non-trivial OS privileges faces potential lateral movement or persistence establishment from a low-privileged local attacker. The 396 existing CVEs tracked against this package signal systemic and chronic security debt in the codebase that warrants a broader posture review beyond this single issue.

How does the attack unfold?

Symlink Preparation

Attacker with low-privilege local access creates a symlink pointing to an approved working directory that will pass OpenClaw's cwd policy validation.

AML.T0079

Approval Solicitation

Attacker submits a system.run request using the symlinked cwd; OpenClaw resolves and validates the path at check time and grants approval since it resolves to a trusted directory.

AML.T0053

Race Window Exploitation

Between approval and execution, attacker atomically replaces the symlink target to point to a sensitive directory such as /etc/cron.d/ or a privileged data path.

AML.T0107

Arbitrary Execution and Persistence

OpenClaw executes the approved command in the attacker-controlled directory, bypassing all approval guardrails and enabling persistent arbitrary command execution on the compromised node.

AML.T0112.000

Symlink Preparation

Attacker with low-privilege local access creates a symlink pointing to an approved working directory that will pass OpenClaw's cwd policy validation.

AML.T0079

Approval Solicitation

Attacker submits a system.run request using the symlinked cwd; OpenClaw resolves and validates the path at check time and grants approval since it resolves to a trusted directory.

AML.T0053

Race Window Exploitation

Between approval and execution, attacker atomically replaces the symlink target to point to a sensitive directory such as /etc/cron.d/ or a privileged data path.

AML.T0107

Arbitrary Execution and Persistence

OpenClaw executes the approved command in the attacker-controlled directory, bypassing all approval guardrails and enabling persistent arbitrary command execution on the compromised node.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C Low

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.2.25 or later; commit f789f880c934 resolves the TOCTOU by binding cwd resolution atomically to the approval checkpoint rather than deferring it to execution time.
Workaround (if patching is delayed): Apply OS-level filesystem isolation using mount namespaces, seccomp profiles, or AppArmor policies to restrict agent working directories and prevent symlink redirection outside approved paths.
Detection: Enable auditd SYSCALL rules or inotify watches on directories exposed as agent cwd targets; alert on symlink modifications (inotify IN_CREATE, IN_MOVED_TO) occurring within the window between OpenClaw approval log events and execution events.
Least privilege: Audit and reduce OS privileges of OpenClaw agent processes; service accounts should have no write access outside designated working directories.
Skill hygiene: Audit installed ClawHub skills against the roughly 17% malicious rate documented in AIID #1368; treat unvetted skill installation as a high-risk operation until a verified skill allowlist process is in place.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system security controls

NIST AI RMF

GOVERN 1.6 - Policies and procedures addressing AI risks

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32043?

CVE-2026-32043 is a time-of-check-time-of-use race condition in OpenClaw's system.run function where the working directory parameter is validated at approval time but resolved at execution, allowing an attacker to swap a symlink in the window between the two events and execute commands in an unauthorized directory context. Despite a Medium CVSS of 6.5, the EPSS percentile places this in the top 1% of CVEs by exploitation likelihood, and critically, the OpenClaw ecosystem is already implicated in active credential-stealing campaigns via malicious third-party skills (AIID #1368) — meaning the threat actor population targeting this platform is real and motivated. The outsized concern for CISOs is that this exploit dismantles the human-in-the-loop approval guardrail directly, not through code execution trickery but through a logic bypass against the agent's primary safety control, leaving any host where OpenClaw agents hold elevated OS privileges at risk of persistent node compromise. Upgrade to OpenClaw 2026.2.25 or later (patch commit f789f880); as an interim control, apply mount namespace or AppArmor confinement to agent working directories to prevent symlink redirection outside approved paths.

Is CVE-2026-32043 actively exploited?

No confirmed active exploitation of CVE-2026-32043 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32043?

1. Patch: Upgrade OpenClaw to 2026.2.25 or later; commit f789f880c934 resolves the TOCTOU by binding cwd resolution atomically to the approval checkpoint rather than deferring it to execution time. 2. Workaround (if patching is delayed): Apply OS-level filesystem isolation using mount namespaces, seccomp profiles, or AppArmor policies to restrict agent working directories and prevent symlink redirection outside approved paths. 3. Detection: Enable auditd SYSCALL rules or inotify watches on directories exposed as agent cwd targets; alert on symlink modifications (inotify IN_CREATE, IN_MOVED_TO) occurring within the window between OpenClaw approval log events and execution events. 4. Least privilege: Audit and reduce OS privileges of OpenClaw agent processes; service accounts should have no write access outside designated working directories. 5. Skill hygiene: Audit installed ClawHub skills against the roughly 17% malicious rate documented in AIID #1368; treat unvetted skill installation as a high-risk operation until a verified skill allowlist process is in place.

What systems are affected by CVE-2026-32043?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, automated AI workflows, local AI agent deployments.

What is the CVSS score for CVE-2026-32043?

CVE-2026-32043 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.10%.

What is the AI security impact?

Affected AI Architectures

agent frameworksautomated AI workflowslocal AI agent deployments

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 1.6

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Exploitation Scenario

An attacker with low-privilege local shell access on an OpenClaw agent host creates a symlink at /tmp/agent-workspace pointing to /var/app/trusted/ — a directory that satisfies OpenClaw's cwd approval policy. The attacker submits a system.run request referencing cwd=/tmp/agent-workspace; OpenClaw resolves the symlink at check time, confirms the path is trusted, and queues the request for execution. In the window between approval and execution — which may span milliseconds to seconds depending on job queue depth and scheduler behavior — the attacker atomically replaces the symlink target to point to /etc/cron.d/. When OpenClaw's execution engine resolves the cwd path again, it follows the now-redirected symlink and runs the approved command inside /etc/cron.d/, allowing the attacker to write a cron entry for persistent arbitrary command execution on the node with no further interaction and no visible approval violation in the audit log.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.