CVE-2026-32988: OpenClaw sandbox escape

CISO Take

CVE-2026-32988 is a time-of-check-time-of-use (TOCTOU) race condition in OpenClaw's fs-bridge module that allows a local attacker with low privileges to write attacker-controlled bytes outside the sandbox's intended directory boundary before the final guarded replace step executes. For AI security teams, this breaks the core trust boundary that OpenClaw's sandboxing provides for agent-driven file operations—a containment failure, not merely a privilege escalation, as the Scope: Changed CVSS indicator confirms. Exploitation requires local access and high attack complexity, and the EPSS score of 0.0008 reflects low near-term exploitation probability with no public exploit or CISA KEV listing; however, AIID #1368 documents adversaries already actively distributing malicious OpenClaw skills that deliver credential stealers through this same agent ecosystem, making a compatible chained attack realistic rather than theoretical. Patch to OpenClaw 2026.3.11 or later immediately; until then, confine agent processes to dedicated OS users with filesystem write access restricted via Linux namespaces or AppArmor to designated working directories only.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 7.5 (High) with Scope: Changed signals that exploitation crosses a security boundary, elevating the operational significance beyond the raw score. Attack Complexity is High—requiring precise race-window timing—and Privileges Required are Low with no user interaction, meaning any code running in the agent's execution context can attempt the exploit without social engineering. The EPSS of 0.0008 and absence of public exploit or KEV listing indicate low imminent opportunistic exploitation risk. However, the 396 other CVEs attributed to the OpenClaw package ecosystem indicate a consistent pattern of insufficient isolation controls, and the ai_agent classification means the attack surface includes any untrusted input processed by the agent. For organizations running OpenClaw agents with write access to shared or sensitive filesystem paths—model artifact caches, configuration directories, cron paths—operational risk should be treated as high despite the low EPSS.

How does the attack unfold?

Initial Access

Attacker publishes a malicious OpenClaw skill or delivers a prompt injection payload into an automated OpenClaw pipeline, gaining code execution within the agent's low-privilege context.

AML.T0010.005

Race Condition Setup

Attacker initiates a legitimate-looking fs-bridge staged write operation while concurrently preparing a symlink or rename on the parent-path alias to fire during the validation window.

AML.T0053

Sandbox Escape

The parent-path alias is swapped between OpenClaw's directory validation check and the final guarded replace, redirecting attacker-controlled bytes to an arbitrary host path outside the sandbox boundary.

AML.T0105

Impact: Arbitrary File Write

Attacker achieves persistent writes to privileged host paths—startup scripts, shared model artifact caches, or configuration directories—enabling persistence, supply chain poisoning of downstream pipeline artifacts, or credential harvesting.

AML.T0112

Initial Access

Attacker publishes a malicious OpenClaw skill or delivers a prompt injection payload into an automated OpenClaw pipeline, gaining code execution within the agent's low-privilege context.

AML.T0010.005

Race Condition Setup

Attacker initiates a legitimate-looking fs-bridge staged write operation while concurrently preparing a symlink or rename on the parent-path alias to fire during the validation window.

AML.T0053

Sandbox Escape

The parent-path alias is swapped between OpenClaw's directory validation check and the final guarded replace, redirecting attacker-controlled bytes to an arbitrary host path outside the sandbox boundary.

AML.T0105

Impact: Arbitrary File Write

Attacker achieves persistent writes to privileged host paths—startup scripts, shared model artifact caches, or configuration directories—enabling persistence, supply chain poisoning of downstream pipeline artifacts, or credential harvesting.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 0% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Changed

C None

I High

A High

What should I do?

5 steps

Patch immediately: upgrade to OpenClaw ≥ 2026.3.11, which atomically pins temporary file creation to a verified parent directory, eliminating the race window.
Workaround until patched: run OpenClaw agent processes under dedicated least-privilege OS accounts; enforce write access exclusively to designated working directories using Linux namespaces, seccomp profiles, or AppArmor rules—do not rely on OpenClaw's application-layer sandbox alone.
Detection: deploy auditd rules or a runtime security tool (e.g., Falco) to alert on file creation or writes to paths outside expected agent temp directories, correlated with OpenClaw process PIDs; alert on rename/symlink operations racing file writes in temp paths.
Architecture hardening: grant OpenClaw agents read-only access to model artifact directories and configuration paths; isolate agent working directories from startup paths and directories shared across trust boundaries.
Skills/supply chain: audit installed third-party OpenClaw skills against the advisory (GHSA-mj4p-rc52-m843) and cross-reference with AIID #1368 indicators.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0010.005 - AI Agent Tool AML.T0053 - AI Agent Tool Invocation AML.T0097 - Virtualization/Sandbox Evasion AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.2 - AI system risk assessment

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32988?

CVE-2026-32988 is a time-of-check-time-of-use (TOCTOU) race condition in OpenClaw's fs-bridge module that allows a local attacker with low privileges to write attacker-controlled bytes outside the sandbox's intended directory boundary before the final guarded replace step executes. For AI security teams, this breaks the core trust boundary that OpenClaw's sandboxing provides for agent-driven file operations—a containment failure, not merely a privilege escalation, as the Scope: Changed CVSS indicator confirms. Exploitation requires local access and high attack complexity, and the EPSS score of 0.0008 reflects low near-term exploitation probability with no public exploit or CISA KEV listing; however, AIID #1368 documents adversaries already actively distributing malicious OpenClaw skills that deliver credential stealers through this same agent ecosystem, making a compatible chained attack realistic rather than theoretical. Patch to OpenClaw 2026.3.11 or later immediately; until then, confine agent processes to dedicated OS users with filesystem write access restricted via Linux namespaces or AppArmor to designated working directories only.

Is CVE-2026-32988 actively exploited?

No confirmed active exploitation of CVE-2026-32988 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32988?

1. Patch immediately: upgrade to OpenClaw ≥ 2026.3.11, which atomically pins temporary file creation to a verified parent directory, eliminating the race window. 2. Workaround until patched: run OpenClaw agent processes under dedicated least-privilege OS accounts; enforce write access exclusively to designated working directories using Linux namespaces, seccomp profiles, or AppArmor rules—do not rely on OpenClaw's application-layer sandbox alone. 3. Detection: deploy auditd rules or a runtime security tool (e.g., Falco) to alert on file creation or writes to paths outside expected agent temp directories, correlated with OpenClaw process PIDs; alert on rename/symlink operations racing file writes in temp paths. 4. Architecture hardening: grant OpenClaw agents read-only access to model artifact directories and configuration paths; isolate agent working directories from startup paths and directories shared across trust boundaries. 5. Skills/supply chain: audit installed third-party OpenClaw skills against the advisory (GHSA-mj4p-rc52-m843) and cross-reference with AIID #1368 indicators.

What systems are affected by CVE-2026-32988?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, multi-tenant agent orchestration pipelines, AI agent sandboxing environments, automated document and content processing pipelines.

What is the CVSS score for CVE-2026-32988?

CVE-2026-32988 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.08%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsmulti-tenant agent orchestration pipelinesAI agent sandboxing environmentsautomated document and content processing pipelines

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0053 AI Agent Tool Invocation

AML.T0097 Virtualization/Sandbox Evasion

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinned to a verified parent directory. Attackers can exploit a race condition in parent-path alias changes to write attacker-controlled bytes outside the intended validated path before the final guarded replace step executes.

Exploitation Scenario

An adversary distributes a malicious OpenClaw skill package—consistent with the AIID #1368 attack pattern—that, when invoked by the agent, initiates a rapid series of fs-bridge staged write operations targeting a file the agent is authorized to create. Concurrently, the skill's payload races a symlink or rename operation on the parent-path alias during the brief window between OpenClaw's parent-directory validation check and the final atomic replace. When the race succeeds, the in-progress write is redirected to an attacker-controlled path—such as a cron directory, ~/.bashrc, or a shared model artifact cache—depositing a credential-harvesting payload or persistence mechanism with no further user interaction required. In automated CI/CD or document-processing pipelines running OpenClaw agents with broad filesystem access, repeated triggering of concurrent writes makes the race statistically reliable within minutes, and the compromise occurs silently within a trusted agent workflow.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.