CVE-2026-32977: OpenClaw TOCTOU race condition

CISO Take

OpenClaw's fs-bridge writeFile commit step contains a time-of-check-time-of-use (TOCTOU) race condition that allows a local attacker with low privileges to redirect committed files outside the container's validated writable path by manipulating parent directory entries in the brief window between path validation and the final move operation. While the raw EPSS score is very low (0.00078) and the attack requires high complexity to reliably win the race window, AI agent frameworks like OpenClaw routinely run with access to sensitive model configurations, tool credentials, and host-mounted data — making any sandbox escape significantly more impactful than an equivalent vulnerability in a standard application. The AIID #1368 incident demonstrates the OpenClaw skills ecosystem is already an active threat target (credential exfiltration via malicious skills), and a sandbox bypass directly compounds that exposure by enabling writes to host paths outside agent control. Upgrade to OpenClaw 2026.3.11 or later; if patching is delayed, enforce strict process-level isolation and monitor for unexpected writes to paths outside designated agent working directories.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium risk overall, elevated in AI agent deployment contexts. The CVSS 6.3 and local attack vector limit opportunistic exploitation, and the high attack complexity requires precise race-window timing. However, the 396 CVEs in the OpenClaw package ecosystem signal a persistently vulnerable codebase, and AI agent processes frequently operate with broader filesystem access than standard applications. No public exploit exists, and the low EPSS (0.00078) suggests limited near-term mass exploitation. Primary risk is targeted abuse by an insider threat or a compromised agent process — scenarios increasingly common in multi-tenant AI infrastructure. In environments where OpenClaw agents share a host with other sensitive workloads, blast radius expands significantly.

How does the attack unfold?

Initial Access

Attacker obtains local low-privilege access to the host running OpenClaw, either via valid credentials or by injecting a malicious skill into the agent's skill ecosystem (per AIID #1368 attack pattern).

AML.T0012

Race Condition Setup

Attacker monitors for fs-bridge writeFile commit activity and prepares a tight loop to replace a parent directory component of the sandbox write path with a symlink targeting a sensitive host directory.

AML.T0053

Sandbox Escape

Attacker wins the race between path validation and the final move operation, redirecting the committed file write to an attacker-controlled path outside the container mount namespace boundary.

AML.T0105

Impact

Attacker overwrites agent tool definitions, skill configurations, or host-accessible secrets — achieving persistent code execution within subsequent agent invocations or exfiltrating host-level credentials.

AML.T0086

Initial Access

Attacker obtains local low-privilege access to the host running OpenClaw, either via valid credentials or by injecting a malicious skill into the agent's skill ecosystem (per AIID #1368 attack pattern).

AML.T0012

Race Condition Setup

Attacker monitors for fs-bridge writeFile commit activity and prepares a tight loop to replace a parent directory component of the sandbox write path with a symlink targeting a sensitive host directory.

AML.T0053

Sandbox Escape

Attacker wins the race between path validation and the final move operation, redirecting the committed file write to an attacker-controlled path outside the container mount namespace boundary.

AML.T0105

Impact

Attacker overwrites agent tool definitions, skill configurations, or host-accessible secrets — achieving persistent code execution within subsequent agent invocations or exfiltrating host-level credentials.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 0% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.3.11 or later — the first release anchoring the container path during the final writeFile move operation.
Isolation: Until patched, run OpenClaw agents in dedicated VMs or gVisor-hardened containers with read-only bind mounts on all paths outside the designated agent working directory.
Monitoring: Alert on file writes to paths outside the agent's configured writable scope; watch for symlink creation or bind-mount operations during agent task execution windows.
Least privilege: Ensure the OS user running OpenClaw has the minimum necessary filesystem permissions, limiting blast radius if the race is won.
Skill audit: Cross-reference installed OpenClaw skills against the AIID #1368 incident profile — malicious skills in the ecosystem are confirmed and could actively attempt to trigger this bypass for credential exfiltration.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - AI system security

NIST AI RMF

MANAGE 2.2 - AI risk treatment and response

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32977?

OpenClaw's fs-bridge writeFile commit step contains a time-of-check-time-of-use (TOCTOU) race condition that allows a local attacker with low privileges to redirect committed files outside the container's validated writable path by manipulating parent directory entries in the brief window between path validation and the final move operation. While the raw EPSS score is very low (0.00078) and the attack requires high complexity to reliably win the race window, AI agent frameworks like OpenClaw routinely run with access to sensitive model configurations, tool credentials, and host-mounted data — making any sandbox escape significantly more impactful than an equivalent vulnerability in a standard application. The AIID #1368 incident demonstrates the OpenClaw skills ecosystem is already an active threat target (credential exfiltration via malicious skills), and a sandbox bypass directly compounds that exposure by enabling writes to host paths outside agent control. Upgrade to OpenClaw 2026.3.11 or later; if patching is delayed, enforce strict process-level isolation and monitor for unexpected writes to paths outside designated agent working directories.

Is CVE-2026-32977 actively exploited?

No confirmed active exploitation of CVE-2026-32977 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32977?

1. Patch: Upgrade OpenClaw to 2026.3.11 or later — the first release anchoring the container path during the final writeFile move operation. 2. Isolation: Until patched, run OpenClaw agents in dedicated VMs or gVisor-hardened containers with read-only bind mounts on all paths outside the designated agent working directory. 3. Monitoring: Alert on file writes to paths outside the agent's configured writable scope; watch for symlink creation or bind-mount operations during agent task execution windows. 4. Least privilege: Ensure the OS user running OpenClaw has the minimum necessary filesystem permissions, limiting blast radius if the race is won. 5. Skill audit: Cross-reference installed OpenClaw skills against the AIID #1368 incident profile — malicious skills in the ecosystem are confirmed and could actively attempt to trigger this bypass for credential exfiltration.

What systems are affected by CVE-2026-32977?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, containerized AI workloads, AI agent orchestration platforms, multi-agent pipelines.

What is the CVSS score for CVE-2026-32977?

CVE-2026-32977 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.08%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscontainerized AI workloadsAI agent orchestration platformsmulti-agent pipelines

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox to redirect committed files outside the validated writable path within the container mount namespace.

Exploitation Scenario

An attacker with local access (or controlling a compromised OpenClaw skill, per AIID #1368) monitors for fs-bridge writeFile activity on the target agent. During the task, the attacker runs a tight loop replacing a parent directory component of the sandbox write path with a symlink pointing to a sensitive host directory such as the OpenClaw skill loader path or the agent's tool configuration directory. When the race is won between the path validation check and the rename/mv commit step, the agent writes the output file to the attacker-controlled host path. In a practical attack chain, the adversary pre-stages a malicious tool definition and triggers the agent to 'commit' it into the skill loader directory, achieving persistent code execution within the agent runtime on all subsequent task invocations without further exploitation.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.