CVE-2026-32920: OpenClaw workspace plugin auto-load

CISO Take

OpenClaw automatically discovers and loads plugins from the `.OpenClaw/extensions/` directory of any workspace it runs in, with no trust verification, meaning an attacker who embeds a crafted plugin in a repository achieves arbitrary code execution the moment a developer or CI/CD pipeline runs OpenClaw from that cloned directory. This is not a theoretical risk: AIID incident #1368 documents that roughly 17% of the OpenClaw skills ecosystem was found malicious in a Feb. 2026 Bitdefender analysis, with samples delivering AMOS stealer and exfiltrating credentials via the same plugin mechanism this CVE enables. EPSS places this in the top 75% for exploitation likelihood and the attack requires zero privileges and zero additional user interaction beyond the normal act of running the tool. Patch all OpenClaw installations to 2026.3.12 or later immediately, audit `.OpenClaw/extensions/` in all existing workspaces, and—pending the patch—restrict OpenClaw execution to internally sourced repositories only.

Sources: NVD EPSS GitHub Advisory ATLAS AIID

What is the risk?

High risk. CVSS 8.4 with AC:L, PR:N, and UI:N means exploitation is straightforward for any attacker able to deliver a malicious repository to the target. The confirmed AIID #1368 incident establishes real-world abuse of the same plugin ecosystem, elevating this beyond a theoretical supply chain risk. AI development environments and CI/CD pipelines are prime targets since they regularly clone and execute third-party repositories with elevated permissions, and the process typically holds AI API keys, SSH credentials, and access to model infrastructure.

How does the attack unfold?

Plugin Delivery

Adversary embeds a malicious plugin in the `.OpenClaw/extensions/` directory of a repository and distributes it via GitHub, open-source template sharing, or a supply chain compromise of a legitimate project.

AML.T0010.005

Auto-Load Trigger

Victim clones the repository and runs OpenClaw from that directory; OpenClaw auto-discovers and loads all plugins in `.OpenClaw/extensions/` without any trust verification or user confirmation prompt.

AML.T0011.000

Code Execution

The malicious plugin executes arbitrary code with the victim's full process privileges, silently, before any visible OpenClaw output appears.

AML.T0050

Host Compromise

Attacker harvests AI API keys, SSH credentials, model artifacts, and CI/CD secrets from the compromised host, or establishes persistent access to the developer's environment.

AML.T0112.000

Plugin Delivery

Adversary embeds a malicious plugin in the `.OpenClaw/extensions/` directory of a repository and distributes it via GitHub, open-source template sharing, or a supply chain compromise of a legitimate project.

AML.T0010.005

Auto-Load Trigger

Victim clones the repository and runs OpenClaw from that directory; OpenClaw auto-discovers and loads all plugins in `.OpenClaw/extensions/` without any trust verification or user confirmation prompt.

AML.T0011.000

Code Execution

The malicious plugin executes arbitrary code with the victim's full process privileges, silently, before any visible OpenClaw output appears.

AML.T0050

Host Compromise

Attacker harvests AI API keys, SSH credentials, model artifacts, and CI/CD secrets from the compromised host, or establishes persistent access to the developer's environment.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch to OpenClaw >= 2026.3.12 immediately — this is the only complete fix.
Before patching, audit .OpenClaw/extensions/ in every workspace for unrecognized files and remove any unexpected plugins.
Until patched, restrict OpenClaw usage to repositories cloned from internally controlled sources.
In CI/CD pipelines, run OpenClaw in an isolated container with a read-only filesystem mount and no access to production secrets.
Add monitoring for unexpected child process spawns or outbound network connections originating from OpenClaw processes.
Rotate any credentials accessible from hosts where OpenClaw ran against unverified repositories since the plugin ecosystem abuse began.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Agent Plugin AML.T0010.001 - AI Software AML.T0010.005 - AI Agent Tool AML.T0011.000 - Unsafe AI Artifacts AML.T0104 - Publish Poisoned AI Agent Tool AML.T0110 - AI Agent Tool Poisoning AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.5 - AI supply chain management

NIST AI RMF

GOVERN-6.1 - Organizational AI supply chain risk governance

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-32920?

OpenClaw automatically discovers and loads plugins from the `.OpenClaw/extensions/` directory of any workspace it runs in, with no trust verification, meaning an attacker who embeds a crafted plugin in a repository achieves arbitrary code execution the moment a developer or CI/CD pipeline runs OpenClaw from that cloned directory. This is not a theoretical risk: AIID incident #1368 documents that roughly 17% of the OpenClaw skills ecosystem was found malicious in a Feb. 2026 Bitdefender analysis, with samples delivering AMOS stealer and exfiltrating credentials via the same plugin mechanism this CVE enables. EPSS places this in the top 75% for exploitation likelihood and the attack requires zero privileges and zero additional user interaction beyond the normal act of running the tool. Patch all OpenClaw installations to 2026.3.12 or later immediately, audit `.OpenClaw/extensions/` in all existing workspaces, and—pending the patch—restrict OpenClaw execution to internally sourced repositories only.

Is CVE-2026-32920 actively exploited?

No confirmed active exploitation of CVE-2026-32920 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32920?

1. Patch to OpenClaw >= 2026.3.12 immediately — this is the only complete fix. 2. Before patching, audit `.OpenClaw/extensions/` in every workspace for unrecognized files and remove any unexpected plugins. 3. Until patched, restrict OpenClaw usage to repositories cloned from internally controlled sources. 4. In CI/CD pipelines, run OpenClaw in an isolated container with a read-only filesystem mount and no access to production secrets. 5. Add monitoring for unexpected child process spawns or outbound network connections originating from OpenClaw processes. 6. Rotate any credentials accessible from hosts where OpenClaw ran against unverified repositories since the plugin ecosystem abuse began.

What systems are affected by CVE-2026-32920?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI development environments, CI/CD pipelines, local AI agent deployments.

What is the CVSS score for CVE-2026-32920?

CVE-2026-32920 has a CVSS v3.1 base score of 8.4 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI development environmentsCI/CD pipelineslocal AI agent deployments

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0010.005 AI Agent Tool

AML.T0011.000 Unsafe AI Artifacts

AML.T0104 Publish Poisoned AI Agent Tool

AML.T0110 AI Agent Tool Poisoning

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.5

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.

Exploitation Scenario

An adversary creates or contributes to a popular AI agent template repository on GitHub and adds a hidden `.OpenClaw/extensions/` directory containing a plugin that executes a reverse shell and exfiltrates local credentials. The repository is promoted in AI developer communities or submitted as an open-source contribution. When a security engineer or developer clones the repo and runs OpenClaw to test the agent workflow, the plugin silently loads, connects back to the attacker's C2 server, and harvests OpenAI/Anthropic API keys, AWS credentials, and SSH keys — all before any visible output appears on screen. No user clicks, no prompts, no warnings.

Weaknesses (CWE)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.