CVE-2026-32020: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32020 is a path traversal via symlink following vulnerability in OpenClaw's Control UI static file handler, allowing low-privileged local attackers to read arbitrary files outside the intended root directory. It affects all OpenClaw (npm) versions up to and including 2026.2.21-2, and was disclosed on March 19, 2026, with a patch released in version 2026.2.22. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) per Feedly intelligence, though the GitHub advisory rates it as Low (3.3) under trusted-operator deployment assumptions (GitHub Advisory, Feedly).

The root cause is classified under CWE-59 (Improper Link Resolution Before File Access / Link Following) and CWE-22 (Path Traversal). The vulnerable code resided in src/gateway/control-ui.ts, where path.join() combined with string-prefix checks was used to validate asset paths lexically, but subsequent file reads used APIs that resolve symbolic links — allowing the confinement check to pass while the actual file served could be outside the root. An attacker with local write access to the Control UI root directory can place a symlink pointing to an arbitrary file on the filesystem; when the static file handler serves the symlink target, it bypasses directory confinement and exposes the linked file's contents. The fix enforces realpathSync containment checks and uses inode identity comparison (TOCTOU mitigation via O_NOFOLLOW and fstat) before serving any file (GitHub Advisory, Fix Commit).

Successful exploitation allows a low-privileged local attacker to read arbitrary files from the host filesystem that the OpenClaw process has permission to access, including sensitive configuration files, credentials, private keys, or other confidential data stored outside the Control UI root. The impact is limited to confidentiality — there is no integrity or availability impact. The severity is higher in shared or multi-tenant environments where multiple users have write access to the Control UI directory, and lower in trusted single-operator deployments (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability requires local access and low-level privileges (write access to the Control UI root directory), which limits its attack surface. The EPSS score is 0.000120, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain local access: Obtain a low-privileged local account or process on the system running OpenClaw with write access to the Control UI root directory (e.g., via a compromised service account or shared hosting environment).
2. Identify the Control UI root: Locate the OpenClaw Control UI root directory on the filesystem (typically configured in the OpenClaw deployment).
3. Create a malicious symlink: Place a symbolic link inside the Control UI root (e.g., under the assets/ subdirectory) pointing to a sensitive target file outside the root, such as /etc/passwd or an application secrets file:

   ln -s /etc/passwd /path/to/control-ui-root/assets/leak.txt

4. Request the symlinked file: Send an HTTP GET request to the OpenClaw Control UI static file handler for the symlinked asset path:

   GET /assets/leak.txt HTTP/1.1
   Host: <openclaw-host>

5. Receive out-of-root file contents: The vulnerable handler resolves the symlink and serves the target file's contents in the HTTP response, exposing the sensitive data (GitHub Advisory, Fix Commit).

• File System: Unexpected symbolic links present within the OpenClaw Control UI root directory (especially under assets/) pointing to locations outside the root; use find /path/to/control-ui-root -type l to enumerate symlinks and verify their targets.
• Logs: HTTP access logs showing GET requests to Control UI asset paths that correspond to filenames not part of the normal UI bundle (e.g., leak.txt, secret.txt, or names matching sensitive system files); unexpected 200 responses for non-standard asset filenames.
• Process: OpenClaw Node.js process reading files from unexpected filesystem locations (e.g., /etc/, home directories, or application secret stores) observable via strace, auditd, or similar file access monitoring tools.

Upgrade OpenClaw to version 2026.2.22 or later, which enforces realpathSync containment and inode identity verification before serving any static file, preventing symlink-based escapes (GitHub Advisory, Fix Commit). For systems that cannot be immediately patched, restrict write access to the Control UI root directory to only trusted operators, and implement filesystem-level access controls (e.g., DAC/MAC policies) to limit which files the OpenClaw process can read. Monitor the Control UI directory for unexpected symbolic link creation as a compensating control (Feedly).