CVE-2026-32007: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32007 is a path traversal vulnerability (CWE-22) in the experimental apply_patch tool of OpenClaw, an npm package. It affects all versions prior to 2026.2.23 and allows attackers with sandbox access to read and modify files outside the designated workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. The vulnerability was published on March 19, 2026, and a patch was released in version 2026.2.23. It carries a CVSS v3.1 base score of 8.1 (High) per Feedly/NVD data, though the GitHub Security Advisory rates it as Moderate (6.8) with higher attack complexity (GitHub Advisory, VulnCheck).

The root cause is improper access control (CWE-284 / CWE-863) combined with path traversal (CWE-22): the apply_patch tool's resolvePatchPath function called sandbox.bridge.resolvePath() without subsequently applying the same workspace-root assertion (assertSandboxPath) used by other filesystem tools. This meant that when sandbox mounts outside the workspace root (e.g., /agent/...) were writable, apply_patch operations could target those paths without restriction. Exploitation requires all of the following opt-in conditions to be active simultaneously: sandbox mode enabled (agents.defaults.sandbox.mode ≠ off), the experimental apply_patch tool enabled (tools.exec.applyPatch.enabled=true), workspace-only enforcement configured (tools.fs.workspaceOnly=true and/or tools.exec.applyPatch.workspaceOnly=true), and writable mounts existing outside the workspace root. The fix, committed as 6634030be31e1a1842967df046c2f2e47490e6bf, adds an assertSandboxPath call within resolvePatchPath whenever workspaceOnly is not explicitly set to false (GitHub Advisory, Fix Commit).

An attacker with sandbox access who meets all opt-in preconditions can use crafted apply_patch operations to write, modify, or delete arbitrary files on the host system via writable mounts outside the workspace root (e.g., /agent/pwned.txt). This threatens both confidentiality (reading sensitive files accessible through mounted paths) and integrity (altering critical system or application files), while availability is not directly impacted. Default installations are not affected, limiting the blast radius to specifically configured deployments (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037% (0.000370), indicating a very low probability of exploitation in the near term. Exploitation is further constrained by the requirement for multiple non-default opt-in configurations to be simultaneously active, significantly reducing the attack surface.

1. Identify a vulnerable target: Locate an OpenClaw deployment (npm package version ≤ 2026.2.22-2) where sandbox mode is enabled, the experimental apply_patch tool is enabled (tools.exec.applyPatch.enabled=true), workspace-only enforcement is active, and writable mounts exist outside the workspace root.
2. Obtain sandbox access: Authenticate or gain access to the OpenClaw sandbox environment with at least low-privilege credentials, as the vulnerability requires an authenticated sandbox user.
3. Craft a malicious patch: Construct an apply_patch payload targeting a path outside the workspace root via a mounted path (e.g., /agent/malicious.txt or another writable mount point outside the workspace):

*** Begin Patch
*** Add File: /agent/pwned.txt
+malicious-content
*** End Patch

4. Submit the patch operation: Invoke the apply_patch tool with the crafted payload. Because resolvePatchPath calls sandbox.bridge.resolvePath() without the workspace-root assertion, the path resolves to the host filesystem location outside the workspace.
5. Achieve arbitrary file write: The patch is applied to the target path on the host system, allowing the attacker to write, modify, or delete files outside the intended workspace boundary (GitHub Advisory, Fix Commit).

• Logs: Application or sandbox logs showing apply_patch operations targeting paths outside the configured workspace root (e.g., paths beginning with /agent/ or other mount points not under the workspace directory); unexpected file creation or modification events in mounted directories outside the workspace.
• File System: Unexpected files created or modified in sandbox-mounted directories outside the workspace root (e.g., /agent/ mount point); files with content inconsistent with normal agent operations or containing attacker-controlled strings.
• Process/Configuration: OpenClaw instances with tools.exec.applyPatch.enabled=true, agents.defaults.sandbox.mode set to a non-default active value, and writable mounts configured outside the workspace root — this combination indicates a potentially exploitable configuration that warrants review.

Upgrade OpenClaw (npm) to version 2026.2.23 or later, which enforces assertSandboxPath for all apply_patch operations in sandbox-mounted paths (Fix Commit, GitHub Advisory). As an interim workaround, disable the experimental apply_patch tool by setting tools.exec.applyPatch.enabled=false (this is the default), or disable sandbox mode entirely. Additionally, restrict sandbox access to trusted users only and audit existing configurations for writable mounts outside the workspace root. Setting tools.exec.applyPatch.workspaceOnly=false explicitly opts out of the protection and should be avoided unless strictly necessary.

The vulnerability was reported by security researcher @tdjackey and disclosed responsibly through GitHub's security advisory process, with the fix credited to the OpenClaw maintainer steipete (GitHub Advisory). VulnCheck independently catalogued the advisory. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking.