CVE-2026-32846: OpenClaw path traversal

CISO Take

OpenClaw's media-handling code fails to properly validate file paths in its isLikelyLocalPath() and isValidMedia() functions, and a bypass involving bare filenames lets an attacker reference files outside the intended sandbox — including environment files and SSH private keys. The bug carries a high severity rating and CWE-22 (path traversal), a well-understood and easy-to-weaponize class, though EPSS currently sits at 0.00688 (top 51% most-likely-to-be-exploited), it's not in CISA KEV, and no public exploit or Nuclei template exists yet — so this looks like an unexploited-but-serious disclosure rather than an active campaign. The real risk multiplier is context: OpenClaw is an AI agent framework, so a successful traversal doesn't just leak a file, it can hand an attacker the credentials (SSH keys, .env secrets) needed to pivot further, and this sits inside a package that already carries 447 other CVEs and a package risk score of 0/100 — a track record that should worry any security team running it. With only 4 known downstream dependents the blast radius is currently narrow, but any organization running OpenClaw should treat this as a priority patch. Upgrade to OpenClaw 2026.3.28 or later immediately, and in the interim restrict the agent's filesystem access (no read access to .env, ~/.ssh, or other credential stores) and monitor logs for anomalous path patterns (../, absolute paths, bare filenames resolving outside the media sandbox).

Sources: NVD GitHub Advisory EPSS CISA KEV VulnCheck ATLAS

What is the risk?

High-severity, low-complexity vulnerability class (CWE-22 path traversal) made worse by the fact the target is an AI agent with broad filesystem interaction by design. Exploitability is straightforward — no authentication or user interaction data is documented, and the flaw stems from incomplete validation logic that a bare-filename bypass gets around, meaning proof-of-concept exploitation likely requires only crafting the right path string. Actual observed exploitation appears low right now (no KEV listing, no public exploit, no scanner template, EPSS in the middle of the distribution), which caps near-term urgency somewhat, but the impact ceiling is severe: disclosure of SSH keys and environment secrets can cascade into full account or infrastructure compromise. The package's own history (447 other CVEs, 0/100 risk score) signals a systemically weak security posture, so treat any OpenClaw deployment as higher-risk than the CVSS/EPSS numbers alone suggest.

How does the attack unfold?

Malicious Media Reference Delivery

Attacker crafts a media reference (bare filename or traversal path) delivered via user input, an ingested document, or other content the OpenClaw agent processes.

AML.T0093

Path Validation Bypass

isLikelyLocalPath() and isValidMedia() fail to reject the crafted reference due to the allowBareFilename bypass, letting it resolve outside the sandboxed media directory.

Local File Access

The agent reads the targeted file from the local filesystem, including system files, environment files, or SSH keys.

AML.T0037

Credential Exposure / Impact

File contents are surfaced in agent output or logs, giving the attacker credentials usable for further compromise, lateral movement, or account takeover.

AML.T0055

Malicious Media Reference Delivery

Attacker crafts a media reference (bare filename or traversal path) delivered via user input, an ingested document, or other content the OpenClaw agent processes.

AML.T0093

Path Validation Bypass

isLikelyLocalPath() and isValidMedia() fail to reject the crafted reference due to the allowBareFilename bypass, letting it resolve outside the sandboxed media directory.

Local File Access

The agent reads the targeted file from the local filesystem, including system files, environment files, or SSH keys.

AML.T0037

Credential Exposure / Impact

File contents are surfaced in agent output or logs, giving the attacker credentials usable for further compromise, lateral movement, or account takeover.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade to OpenClaw 2026.3.28 or later, which fixes the isLikelyLocalPath()/isValidMedia() validation and closes the allowBareFilename bypass (see patch commit 4797bbc). Until patched, run the agent in a hardened sandbox/container with no read access to sensitive paths (.env, ~/.ssh, cloud credential files) and apply filesystem allowlisting at the OS or container layer rather than relying solely on application-level checks. Review logs of media/file references processed by the agent for path traversal indicators (../, absolute paths, unexpected bare filenames resolving outside expected media directories). If the agent processed untrusted media before patching, rotate any credentials or SSH keys it had read access to, since prior exposure cannot be ruled out retroactively.

How is it classified?

Data Leakage Data Extraction Agent AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32846?

OpenClaw's media-handling code fails to properly validate file paths in its isLikelyLocalPath() and isValidMedia() functions, and a bypass involving bare filenames lets an attacker reference files outside the intended sandbox — including environment files and SSH private keys. The bug carries a high severity rating and CWE-22 (path traversal), a well-understood and easy-to-weaponize class, though EPSS currently sits at 0.00688 (top 51% most-likely-to-be-exploited), it's not in CISA KEV, and no public exploit or Nuclei template exists yet — so this looks like an unexploited-but-serious disclosure rather than an active campaign. The real risk multiplier is context: OpenClaw is an AI agent framework, so a successful traversal doesn't just leak a file, it can hand an attacker the credentials (SSH keys, .env secrets) needed to pivot further, and this sits inside a package that already carries 447 other CVEs and a package risk score of 0/100 — a track record that should worry any security team running it. With only 4 known downstream dependents the blast radius is currently narrow, but any organization running OpenClaw should treat this as a priority patch. Upgrade to OpenClaw 2026.3.28 or later immediately, and in the interim restrict the agent's filesystem access (no read access to .env, ~/.ssh, or other credential stores) and monitor logs for anomalous path patterns (../, absolute paths, bare filenames resolving outside the media sandbox).

Is CVE-2026-32846 actively exploited?

No confirmed active exploitation of CVE-2026-32846 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32846?

Upgrade to OpenClaw 2026.3.28 or later, which fixes the isLikelyLocalPath()/isValidMedia() validation and closes the allowBareFilename bypass (see patch commit 4797bbc). Until patched, run the agent in a hardened sandbox/container with no read access to sensitive paths (.env, ~/.ssh, cloud credential files) and apply filesystem allowlisting at the OS or container layer rather than relying solely on application-level checks. Review logs of media/file references processed by the agent for path traversal indicators (../, absolute paths, unexpected bare filenames resolving outside expected media directories). If the agent processed untrusted media before patching, rotate any credentials or SSH keys it had read access to, since prior exposure cannot be ruled out retroactively.

What systems are affected by CVE-2026-32846?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent media/file ingestion, local tool execution sandboxes.

What is the CVSS score for CVE-2026-32846?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent media/file ingestionlocal tool execution sandboxes

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025, LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.

Exploitation Scenario

An attacker supplies or plants a crafted media reference — for example a bare filename or traversal sequence disguised as an image path — in content the OpenClaw agent will process, such as a chat input, ingested document, or web page the agent is asked to summarize. Because isLikelyLocalPath() and isValidMedia() incompletely validate this input, and the allowBareFilename logic can be abused to escape the intended sandbox, the agent resolves and reads a file outside its allowed media directory, such as ~/.ssh/id_rsa or a .env file containing API keys. The agent then returns or logs that file's contents as part of its normal output, handing the attacker credentials they can use for lateral movement, account takeover, or further supply-chain abuse (e.g., publishing malicious OpenClaw skills, echoing the pattern seen in AIID #1368).

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.