CVE-2026-32056: OpenClaw RCE — HIGH

CISO Take

OpenClaw's system.run function fails to sanitize the HOME and ZDOTDIR shell environment variables, allowing a remote attacker with low-privilege access to inject malicious startup files (.bash_profile, .zshenv) that execute arbitrary code before the platform's command allowlist is evaluated — making that security control completely ineffective. Although EPSS sits at 0.56% with no public exploit or KEV listing, the underlying weakness is CWE-78 (OS Command Injection), a well-understood class, and the allowlist bypass substantially lowers the effective exploitation bar for any attacker who already holds a low-privilege foothold. OpenClaw is an AI agent framework where system.run is a core capability; successful exploitation hands an adversary direct shell access to the host running the agent, with blast radius extending to credentials, model artifacts, RAG data sources, and every downstream integration the agent reaches — a profile consistent with real-world credential-theft incidents already attributed to the OpenClaw ecosystem (AIID #1368). Upgrade to OpenClaw 2026.2.22 or later immediately; if patching is blocked, restrict system.run invocation to highly trusted roles, enforce strict environment variable allowlisting at the OS level, and audit all agent tool configurations for untrusted input paths.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

The CVSS 7.5 High rating is well-calibrated: network reachable, no user interaction, and full CIA impact offset by high attack complexity and the need for low-privilege credentials. In AI agent deployments, however, those prerequisites are often easy to satisfy — agents routinely accept external user inputs as part of their function, and low-privilege API tokens are widely distributed. The allowlist bypass is the critical aggravating factor: operators who believed system.run was sandboxed by the allowlist have been operating with a false sense of security. With 396 CVEs in the same package and 4 downstream dependents, the package's security hygiene history is a concern. Effective risk is moderate-to-high for any organisation running OpenClaw in a networked or multi-tenant AI agent environment.

How does the attack unfold?

Initial Access

Attacker authenticates to a networked OpenClaw instance using low-privilege credentials (stolen token, leaked CI/CD secret, or phished API key) to gain the ability to invoke agent functions.

AML.T0012

Environment Manipulation

Attacker crafts a request that triggers system.run while supplying manipulated HOME or ZDOTDIR environment variables pointing to an attacker-controlled directory containing a malicious .bash_profile or .zshenv.

AML.T0049

Allowlist Bypass & Execution

The shell spawned by system.run reads and executes the injected startup file before the command allowlist is evaluated, running arbitrary attacker-supplied commands with the agent's runtime privileges.

AML.T0050

Impact

Attacker achieves full code execution on the AI agent host, harvesting credentials, API keys, model artifacts, and RAG data source access, with potential for lateral movement to downstream AI infrastructure.

AML.T0025

Initial Access

Attacker authenticates to a networked OpenClaw instance using low-privilege credentials (stolen token, leaked CI/CD secret, or phished API key) to gain the ability to invoke agent functions.

AML.T0012

Environment Manipulation

Attacker crafts a request that triggers system.run while supplying manipulated HOME or ZDOTDIR environment variables pointing to an attacker-controlled directory containing a malicious .bash_profile or .zshenv.

AML.T0049

Allowlist Bypass & Execution

The shell spawned by system.run reads and executes the injected startup file before the command allowlist is evaluated, running arbitrary attacker-supplied commands with the agent's runtime privileges.

AML.T0050

Impact

Attacker achieves full code execution on the AI agent host, harvesting credentials, API keys, model artifacts, and RAG data source access, with potential for lateral movement to downstream AI infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: upgrade OpenClaw to version 2026.2.22 or later — the patch commit (c2c7114e) explicitly sanitises HOME and ZDOTDIR before shell invocation.
Interim workaround: restrict system.run to a controlled service account; explicitly set HOME and ZDOTDIR to trusted fixed paths in the process environment before any OpenClaw invocation using wrapper scripts or systemd environment directives.
Detection: monitor for unexpected shell startup file modifications (.bash_profile, .zshenv, .bashrc) in directories writable by the OpenClaw service account; alert on shell processes spawned by OpenClaw that execute binaries not on the approved allowlist.
Review: audit all OpenClaw agent configurations for inputs that flow into system.run without sanitisation; check for credential exposure if the service account has broad access.
Dependency review: evaluate the 4 downstream dependents for indirect exposure.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Supply Chain Agent Plugin Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.3 - Information security in AI system development

NIST AI RMF

MANAGE 3.2 - Treatment of identified AI risks

OWASP LLM Top 10

LLM07:2025 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32056?

OpenClaw's system.run function fails to sanitize the HOME and ZDOTDIR shell environment variables, allowing a remote attacker with low-privilege access to inject malicious startup files (.bash_profile, .zshenv) that execute arbitrary code before the platform's command allowlist is evaluated — making that security control completely ineffective. Although EPSS sits at 0.56% with no public exploit or KEV listing, the underlying weakness is CWE-78 (OS Command Injection), a well-understood class, and the allowlist bypass substantially lowers the effective exploitation bar for any attacker who already holds a low-privilege foothold. OpenClaw is an AI agent framework where system.run is a core capability; successful exploitation hands an adversary direct shell access to the host running the agent, with blast radius extending to credentials, model artifacts, RAG data sources, and every downstream integration the agent reaches — a profile consistent with real-world credential-theft incidents already attributed to the OpenClaw ecosystem (AIID #1368). Upgrade to OpenClaw 2026.2.22 or later immediately; if patching is blocked, restrict system.run invocation to highly trusted roles, enforce strict environment variable allowlisting at the OS level, and audit all agent tool configurations for untrusted input paths.

Is CVE-2026-32056 actively exploited?

No confirmed active exploitation of CVE-2026-32056 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32056?

1. Patch: upgrade OpenClaw to version 2026.2.22 or later — the patch commit (c2c7114e) explicitly sanitises HOME and ZDOTDIR before shell invocation. 2. Interim workaround: restrict system.run to a controlled service account; explicitly set HOME and ZDOTDIR to trusted fixed paths in the process environment before any OpenClaw invocation using wrapper scripts or systemd environment directives. 3. Detection: monitor for unexpected shell startup file modifications (.bash_profile, .zshenv, .bashrc) in directories writable by the OpenClaw service account; alert on shell processes spawned by OpenClaw that execute binaries not on the approved allowlist. 4. Review: audit all OpenClaw agent configurations for inputs that flow into system.run without sanitisation; check for credential exposure if the service account has broad access. 5. Dependency review: evaluate the 4 downstream dependents for indirect exposure.

What systems are affected by CVE-2026-32056?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Agentic task orchestration pipelines, Multi-agent systems with shell execution capabilities, CI/CD pipelines with AI enrichment steps, RAG pipelines with agent-orchestrated retrieval.

What is the CVSS score for CVE-2026-32056?

CVE-2026-32056 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.56%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksAgentic task orchestration pipelinesMulti-agent systems with shell execution capabilitiesCI/CD pipelines with AI enrichment stepsRAG pipelines with agent-orchestrated retrieval

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.3

NIST AI RMF: MANAGE 3.2

OWASP LLM Top 10: LLM07:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bash_profile or .zshenv to achieve arbitrary code execution before allowlist-evaluated commands are executed.

Exploitation Scenario

An adversary with a low-privilege API token for an OpenClaw-based AI agent — obtained via phishing, credential stuffing, or a leaked CI/CD secret — crafts a request to the agent that triggers a system.run call while supplying a manipulated HOME or ZDOTDIR environment variable pointing to an attacker-controlled directory hosted on a shared or writable path. When OpenClaw's shell spawns, it reads the injected .zshenv or .bash_profile before evaluating any allowlisted commands; that startup file executes a reverse shell or downloads a credential-harvesting binary. Because execution happens before the allowlist gate, no command-restriction policy fires. The attacker then moves laterally using credentials found in the agent's environment — Anthropic API keys, database connection strings, Stripe secrets — achieving persistence by planting backdoors in the model artifact store or RAG ingestion pipeline.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.