CVE-2026-32979: OpenClaw TOCTOU race enables local

CISO Take

OpenClaw before 2026.3.11 contains a time-of-check/time-of-use (TOCTOU) race condition that allows a local attacker to swap an approved script with malicious code in the window between user approval and execution, achieving arbitrary code execution under the OpenClaw runtime user's privileges. Despite requiring local access, OpenClaw sits at the 97th EPSS percentile for exploitation likelihood, and real-world incident AIID #1368 confirms that the OpenClaw skills ecosystem has already been weaponized—Bitdefender researchers found ~17% of audited third-party skills were malicious and delivering credential stealers—demonstrating active adversary familiarity with this platform's execution model. With High impact across confidentiality, integrity, and availability, and 396 prior CVEs recorded for this package, the security posture of OpenClaw warrants serious scrutiny beyond this single flaw. Patch immediately to 2026.3.11, restrict which users can modify scripts in directories monitored by OpenClaw, and audit all installed third-party skills for signs of tampering or malicious payloads.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High severity (CVSS 7.3) with a local attack vector reduces direct internet exposure, but the low attack complexity and low privileges required make exploitation straightforward for any user with local system access. The 97th EPSS percentile signals meaningful exploitation likelihood relative to the broader CVE population, and the 396 prior CVEs in this package raise serious concerns about systemic security hygiene. AI agent deployments where untrusted or semi-trusted users interact with the script approval workflow—such as shared CI/CD environments, multi-user development boxes, or enterprise workstations with lateral movement exposure—represent the highest-risk scenarios. The confirmed real-world exploitation of OpenClaw's broader ecosystem elevates urgency beyond what CVSS alone suggests.

How does the attack unfold?

Local Access

Attacker obtains local access with low privileges on a host running OpenClaw, via compromised developer workstation, shared CI/CD environment, or lateral movement from a separate foothold.

AML.T0012

Race Window Identification

Attacker discovers that OpenClaw cannot bind exactly to the approved file (path-based reference, no hash pinning), opening an exploitable window between user approval and agent execution.

AML.T0084

Script Substitution

Attacker monitors filesystem events for the approval action, then replaces the approved script file with a malicious payload before OpenClaw executes it.

AML.T0081

Code Execution and Credential Theft

OpenClaw executes the attacker's payload under the runtime user's context, enabling exfiltration of API keys, agent configuration, and access to all connected tools and data sources.

AML.T0050

Local Access

Attacker obtains local access with low privileges on a host running OpenClaw, via compromised developer workstation, shared CI/CD environment, or lateral movement from a separate foothold.

AML.T0012

Race Window Identification

Attacker discovers that OpenClaw cannot bind exactly to the approved file (path-based reference, no hash pinning), opening an exploitable window between user approval and agent execution.

AML.T0084

Script Substitution

Attacker monitors filesystem events for the approval action, then replaces the approved script file with a malicious payload before OpenClaw executes it.

AML.T0081

Code Execution and Credential Theft

OpenClaw executes the attacker's payload under the runtime user's context, enabling exfiltration of API keys, agent configuration, and access to all connected tools and data sources.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI Required

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch immediately to OpenClaw 2026.3.11 or later, which addresses the approval integrity flaw.
If immediate patching is not possible, restrict filesystem write permissions on script directories monitored by OpenClaw to only authorized administrative users—remove write access for the approving user and any low-privilege accounts.
Implement file integrity monitoring (e.g., AIDE, Wazuh) on OpenClaw script directories to alert on modifications between approval events and execution.
Apply least privilege to the OpenClaw runtime user—it should not hold elevated system privileges, API keys beyond its minimum operating scope, or access to credential stores.
Audit all installed OpenClaw skills from ClawHub against AIID #1368 findings; treat any skill from an unverified publisher as untrusted until reviewed.
Monitor for unexpected child processes spawned by the OpenClaw runtime user as a detection indicator of successful exploitation.

How is it classified?

Code Execution Supply Chain Agent AML.T0011 - User Execution AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration AML.T0110 - AI Agent Tool Poisoning AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

Clause 8.4 - AI system operation — integrity of inputs

NIST AI RMF

MANAGE 2.2 - Mechanisms for managing AI risks — operational controls

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32979?

OpenClaw before 2026.3.11 contains a time-of-check/time-of-use (TOCTOU) race condition that allows a local attacker to swap an approved script with malicious code in the window between user approval and execution, achieving arbitrary code execution under the OpenClaw runtime user's privileges. Despite requiring local access, OpenClaw sits at the 97th EPSS percentile for exploitation likelihood, and real-world incident AIID #1368 confirms that the OpenClaw skills ecosystem has already been weaponized—Bitdefender researchers found ~17% of audited third-party skills were malicious and delivering credential stealers—demonstrating active adversary familiarity with this platform's execution model. With High impact across confidentiality, integrity, and availability, and 396 prior CVEs recorded for this package, the security posture of OpenClaw warrants serious scrutiny beyond this single flaw. Patch immediately to 2026.3.11, restrict which users can modify scripts in directories monitored by OpenClaw, and audit all installed third-party skills for signs of tampering or malicious payloads.

Is CVE-2026-32979 actively exploited?

No confirmed active exploitation of CVE-2026-32979 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32979?

1. Patch immediately to OpenClaw 2026.3.11 or later, which addresses the approval integrity flaw. 2. If immediate patching is not possible, restrict filesystem write permissions on script directories monitored by OpenClaw to only authorized administrative users—remove write access for the approving user and any low-privilege accounts. 3. Implement file integrity monitoring (e.g., AIDE, Wazuh) on OpenClaw script directories to alert on modifications between approval events and execution. 4. Apply least privilege to the OpenClaw runtime user—it should not hold elevated system privileges, API keys beyond its minimum operating scope, or access to credential stores. 5. Audit all installed OpenClaw skills from ClawHub against AIID #1368 findings; treat any skill from an unverified publisher as untrusted until reviewed. 6. Monitor for unexpected child processes spawned by the OpenClaw runtime user as a detection indicator of successful exploitation.

What systems are affected by CVE-2026-32979?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration, script-based automation pipelines, local AI agent deployments.

What is the CVSS score for CVE-2026-32979?

CVE-2026-32979 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestrationscript-based automation pipelineslocal AI agent deployments

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

AML.T0110 AI Agent Tool Poisoning

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: Clause 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval and execution when exact file binding cannot occur. Remote attackers can change approved local scripts before execution to achieve unintended code execution as the OpenClaw runtime user.

Exploitation Scenario

An attacker with local access—such as a malicious insider, a developer workstation compromised via phishing, or an account obtained through lateral movement in a shared build environment—identifies an OpenClaw agent that periodically executes approved scripts. When exact file binding fails (the approval references a path rather than a cryptographic hash of the file content), the attacker monitors filesystem events to detect the approval. In the race window between approval and execution, the attacker replaces the legitimate script with a payload that exfiltrates OpenClaw's stored API keys and agent configuration, or establishes a reverse shell. The OpenClaw runtime then executes the malicious script with its full privileges, and the attacker gains access to all connected tools, model endpoints, and data sources the agent can reach—mirroring the credential-theft pattern observed in AIID #1368.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.