CVE-2026-32054: OpenClaw symlink traversal enables

CISO Take

OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability (CWE-59) in browser trace and download output path handling that allows a local low-privileged attacker to route agent file writes to arbitrary filesystem paths, enabling overwrite of credentials, SSH keys, cron jobs, or agent configuration files. Although the raw EPSS score is low (0.00126), this CVE ranks in the top 97th EPSS percentile across all CVEs — and the package's history of 396 prior CVEs signals systemic security debt that experienced attackers actively track. The attack requires local access and high complexity, limiting exposure on isolated single-user deployments, but shared developer workstations, CI/CD runners, and multi-tenant AI agent infrastructure where OpenClaw operates expand the blast radius significantly. Upgrade to 2026.2.25 immediately; if patching is delayed, restrict the OpenClaw process to a dedicated low-privilege service account and enable symlink monitoring on its temp root.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Medium risk overall, elevated for shared or multi-user infrastructure. CVSS 6.5 with local attack vector and high complexity constrain immediate internet-facing exposure, but the top 97th EPSS percentile indicates this vulnerability class is consistently targeted in practice. The 396-CVE history of this package is a red flag — it reflects a pattern of systemic security weaknesses that opportunistic attackers recognize as reliable territory. No public exploit or CISA KEV listing exists at analysis date, but the patch commit (496a76c) is publicly visible, which may accelerate weaponization. Risk is highest where OpenClaw runs on shared compute with multiple low-privilege users, which is common in agentic CI/CD pipelines and developer automation workflows.

How does the attack unfold?

Local Access

Attacker obtains a low-privilege shell on a host running OpenClaw, satisfying the AV:L/PR:L prerequisites — common on shared CI/CD runners or multi-user developer workstations.

Symlink Placement

Attacker pre-creates a symlink inside OpenClaw's managed temp root pointing to a high-value target file (e.g., ~/.ssh/authorized_keys, a cron job file, or a stored API credential).

AML.T0079

Agent-Triggered Write

Attacker triggers or waits for a browser trace or file download operation in OpenClaw; the agent resolves the output path, follows the symlink, and writes attacker-controlled content to the target outside the intended sandbox.

AML.T0053

Arbitrary File Overwrite

Target file is overwritten — enabling SSH persistence, cron-based code execution, credential theft via config file replacement, or availability impact by corrupting critical agent or system files.

AML.T0112.000

Local Access

Attacker obtains a low-privilege shell on a host running OpenClaw, satisfying the AV:L/PR:L prerequisites — common on shared CI/CD runners or multi-user developer workstations.

Symlink Placement

Attacker pre-creates a symlink inside OpenClaw's managed temp root pointing to a high-value target file (e.g., ~/.ssh/authorized_keys, a cron job file, or a stored API credential).

AML.T0079

Agent-Triggered Write

Attacker triggers or waits for a browser trace or file download operation in OpenClaw; the agent resolves the output path, follows the symlink, and writes attacker-controlled content to the target outside the intended sandbox.

AML.T0053

Arbitrary File Overwrite

Target file is overwritten — enabling SSH persistence, cron-based code execution, credential theft via config file replacement, or availability impact by corrupting critical agent or system files.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C Low

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.2.25 or later (patch commit 496a76c03ba85e15ea715e5a583e498ae04d36e3 resolves the path handling flaw).
Least-privilege: Run the OpenClaw process under a dedicated low-privilege service account isolated from sensitive credential paths and agent configuration directories.
Filesystem hardening: Configure the OpenClaw temp root on a mount namespace or chroot that prevents symlink traversal to parent directories; alternatively set sticky-bit restrictions and disable cross-device symlinks.
Detection: Monitor the OpenClaw temp directory for unexpected symlink creation using inotifywait, Falco, or AIDE; alert on any symlink whose target resolves outside the temp root.
Audit: Enumerate all files writable by the OpenClaw process account to identify high-value overwrite targets before an attacker does.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0105 - Escape to Host AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.9.2 - AI System Security Testing

NIST AI RMF

MANAGE 2.2 - AI Risk Monitoring and Response

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32054?

OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability (CWE-59) in browser trace and download output path handling that allows a local low-privileged attacker to route agent file writes to arbitrary filesystem paths, enabling overwrite of credentials, SSH keys, cron jobs, or agent configuration files. Although the raw EPSS score is low (0.00126), this CVE ranks in the top 97th EPSS percentile across all CVEs — and the package's history of 396 prior CVEs signals systemic security debt that experienced attackers actively track. The attack requires local access and high complexity, limiting exposure on isolated single-user deployments, but shared developer workstations, CI/CD runners, and multi-tenant AI agent infrastructure where OpenClaw operates expand the blast radius significantly. Upgrade to 2026.2.25 immediately; if patching is delayed, restrict the OpenClaw process to a dedicated low-privilege service account and enable symlink monitoring on its temp root.

Is CVE-2026-32054 actively exploited?

No confirmed active exploitation of CVE-2026-32054 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32054?

1. Patch: Upgrade OpenClaw to 2026.2.25 or later (patch commit 496a76c03ba85e15ea715e5a583e498ae04d36e3 resolves the path handling flaw). 2. Least-privilege: Run the OpenClaw process under a dedicated low-privilege service account isolated from sensitive credential paths and agent configuration directories. 3. Filesystem hardening: Configure the OpenClaw temp root on a mount namespace or chroot that prevents symlink traversal to parent directories; alternatively set sticky-bit restrictions and disable cross-device symlinks. 4. Detection: Monitor the OpenClaw temp directory for unexpected symlink creation using inotifywait, Falco, or AIDE; alert on any symlink whose target resolves outside the temp root. 5. Audit: Enumerate all files writable by the OpenClaw process account to identify high-value overwrite targets before an attacker does.

What systems are affected by CVE-2026-32054?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Browser-use and computer-use agents, Agentic CI/CD pipelines, Local AI agent deployments on shared infrastructure.

What is the CVSS score for CVE-2026-32054?

CVE-2026-32054 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksBrowser-use and computer-use agentsAgentic CI/CD pipelinesLocal AI agent deployments on shared infrastructure

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0105 Escape to Host

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managed temp root directory. An attacker with local access can create symlinks to route file writes outside the intended temp directory, enabling arbitrary file overwrite on the affected system.

Exploitation Scenario

An attacker with a low-privilege shell on a CI/CD runner executing OpenClaw tasks identifies the managed temp directory at /tmp/openclaw/. Before the next scheduled browser trace run, they create a symlink: /tmp/openclaw/trace_session_001 -> /home/ciagent/.ssh/authorized_keys. When OpenClaw next executes a browser trace job, it resolves the output path, follows the symlink, and writes attacker-controlled content to the SSH authorized_keys file — granting the attacker persistent SSH access as the CI agent user. In a pipeline context the target could instead be a stored cloud credential file or a deploy script, enabling supply-chain compromise of downstream builds or lateral movement into cloud environments connected to the CI system.

Weaknesses (CWE)

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.