CVE-2026-32009: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32009 is a policy bypass vulnerability in OpenClaw's safeBins allowlist evaluation, classified as an untrusted search path issue (CWE-426). Affecting OpenClaw versions ≤ 2026.2.23 (npm package for Node.js), the flaw allows an attacker with write access to package-manager directories such as /opt/homebrew/bin or /usr/local/bin to place a malicious binary with the same name as an allowlisted executable, achieving arbitrary command execution within the OpenClaw runtime context. The vulnerability was published on March 19, 2026, with a patch released in version 2026.2.24. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, Feedly).

The root cause lies in exec-safe-bin-trust.ts, where the DEFAULT_SAFE_BIN_TRUSTED_DIRS array historically included writable package-manager paths (/opt/homebrew/bin, /usr/local/bin, /opt/local/bin, /snap/bin, /run/current-system/sw/bin) alongside immutable system paths. The safeBins allowlist evaluation trusted any executable resolved to one of these directories without verifying that the directory itself was write-protected, enabling a binary hijacking attack (CAPEC-38, MITRE ATT&CK T1574.007). An attacker who can write to one of these trusted directories simply places a malicious binary named identically to an allowlisted tool (e.g., jq) — when OpenClaw invokes that tool, the attacker-controlled binary executes instead. Exploitation requires local access and write privileges to the affected directories (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary commands within the OpenClaw runtime context, resulting in high confidentiality, integrity, and availability impact on the affected system. Because OpenClaw operates as an AI coding agent with broad filesystem and execution permissions, a compromised runtime could expose sensitive source code, credentials, or configuration files, and could be leveraged for lateral movement within the development environment. The scope is limited to the local system (CVSS scope: Unchanged), but the consequences within that context are severe given OpenClaw's privileged operational role (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.01%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and write privileges to package-manager directories, which limits the attacker pool but is realistic in shared development or CI/CD environments (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target system running OpenClaw ≤ 2026.2.23 in a Node.js environment where the safeBins allowlist is configured with tools such as jq.
2. Identify writable trusted directory: Confirm write access to one of the previously trusted directories — /opt/homebrew/bin, /usr/local/bin, /opt/local/bin, /snap/bin, or /run/current-system/sw/bin.
3. Craft malicious binary: Create a malicious executable (e.g., a shell script or compiled binary) with the same name as an allowlisted safe-bin tool (e.g., jq) that performs the attacker's desired action (e.g., exfiltrate files, establish a reverse shell, or modify project code).
4. Place binary in trusted directory: Copy the malicious binary to the writable trusted directory (e.g., cp malicious_jq /opt/homebrew/bin/jq && chmod +x /opt/homebrew/bin/jq).
5. Trigger execution: Wait for or induce OpenClaw to invoke the allowlisted tool. Because the directory is trusted, the safeBins policy check is satisfied and the malicious binary executes within the OpenClaw runtime context.
6. Achieve objective: The attacker's payload runs with OpenClaw's runtime privileges, enabling arbitrary command execution, data exfiltration, or further compromise (GitHub Advisory, Fix Commit).

• File System: Unexpected or recently modified binaries in /opt/homebrew/bin, /usr/local/bin, /opt/local/bin, /snap/bin, or /run/current-system/sw/bin with names matching common tools (e.g., jq, curl, git); file timestamps or hashes inconsistent with the legitimate package-manager-installed version.
• Process: Unusual child processes spawned by the OpenClaw Node.js process (e.g., reverse shell connections, unexpected network utilities, or scripting interpreters) that do not match expected tool behavior.
• Logs: OpenClaw execution logs showing invocation of a safeBins-allowlisted tool followed by unexpected output, errors, or network activity; audit logs (e.g., auditd) recording writes to trusted binary directories by non-package-manager processes.
• Network: Unexpected outbound connections from the OpenClaw process or its child processes to external IP addresses, particularly shortly after a safe-bin tool invocation.

Upgrade OpenClaw to version 2026.2.24 or later, which restricts the default safeBins trusted directories to immutable system paths (/bin and /usr/bin) only (Fix Commit). If package-manager paths such as /opt/homebrew/bin or /usr/local/bin are required for safe-bin tools, explicitly opt in by adding them to tools.exec.safeBinTrustedDirs in the OpenClaw configuration after verifying those directories are appropriately access-controlled. As an interim workaround on unpatched versions, restrict write access to all previously trusted directories to privileged accounts only, and audit those directories for unexpected binaries (GitHub Advisory).

The vulnerability was reported by security researcher @tdjackey and disclosed by maintainer steipete via the GitHub Security Advisory on February 25, 2026, the same day the patched version 2026.2.24 was published to npm. A blog post by Nesbitt (April 8, 2026) discussed broader package security problems for AI agents in the context of this and related issues, reflecting community interest in the security implications of AI coding agents with broad execution permissions (Nesbitt Blog, GitHub Advisory).