CVE-2026-32026: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32026 is a path traversal vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.2.24. The flaw exists in sandbox media path handling, where absolute paths under the host's temporary directory (os.tmpdir()) were accepted as trusted media inputs even when those paths fell outside the active sandbox root. This allows attackers to read and exfiltrate arbitrary files from the host temporary directory via attachment delivery mechanisms. It was disclosed on March 19, 2026, with a patch published on February 25, 2026 (version 2026.2.24). The vulnerability carries a CVSS v3.1 base score of 8.6 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) and CWE-284 (Improper Access Control). In affected versions, the resolveAllowedTmpMediaPath function in src/agents/sandbox-paths.ts validated media paths by checking only whether they resided under os.tmpdir() — the broad host temporary directory — rather than restricting them to the OpenClaw-managed temp root (resolvePreferredOpenClawTmpDir()). Because outbound attachment hydration consumed these paths as already validated, an attacker-controlled media reference pointing to any file under the host's /tmp (or equivalent) would bypass the sandbox boundary and be delivered as an attachment. The fix replaces the broad os.tmpdir() trust anchor with resolvePreferredOpenClawTmpDir() and adds CI lint guardrails (check-no-random-messaging-tmp.mjs) to prevent regressions (GitHub Advisory, Patch Commit).

Successful exploitation allows a low-privileged network attacker to read and exfiltrate arbitrary files stored anywhere under the host's temporary directory (/tmp or equivalent) without user interaction. The confidentiality impact is rated High, as sensitive data — such as session tokens, credentials, or intermediate processing artifacts — stored in temporary locations could be exposed through the attachment delivery mechanism. Integrity and availability are not directly affected, but data exfiltration from the temp directory could facilitate further attacks or lateral movement (GitHub Advisory, Feedly).

No public proof-of-concept exploit is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.055% (0.000550), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege network access but no user interaction, making it relatively straightforward for an authenticated attacker to attempt (Feedly, GitHub Advisory).

1. Identify a vulnerable instance: Locate a deployment running OpenClaw (npm) version ≤ 2026.2.23 with network-accessible messaging or attachment endpoints.
2. Obtain low-privilege access: Authenticate to the OpenClaw instance with any valid low-privilege account or API token, as the vulnerability requires only PR:L (low privileges).
3. Craft a malicious media reference: Construct a media reference (e.g., an absolute file path or file:// URL) pointing to a target file under the host's os.tmpdir() directory but outside the OpenClaw sandbox root — for example, file:///tmp/sensitive-session-data.json.
4. Submit the malicious reference: Send the crafted media reference to the OpenClaw messaging or channel endpoint that processes media attachments (e.g., via a message send or attachment API call).
5. Trigger attachment hydration: The vulnerable resolveAllowedTmpMediaPath function validates the path against the broad os.tmpdir() boundary (rather than the OpenClaw-managed tmp root), accepts it as trusted, and passes it to the outbound attachment delivery pipeline.
6. Receive exfiltrated file: The contents of the targeted host tmp file are delivered as an attachment through the messaging channel, completing the file read and exfiltration (GitHub Advisory, Patch Commit).

• Network: Unusual outbound attachment deliveries containing file contents from /tmp or the host temporary directory; unexpected data in message attachment payloads originating from temp file paths.
• Logs: OpenClaw application logs showing media path resolution for absolute paths under os.tmpdir() that are outside the expected OpenClaw sandbox root; repeated attachment hydration requests referencing file:// URLs or absolute /tmp/... paths.
• File System: Access timestamps updated on files within /tmp (or OS equivalent) that are unrelated to normal OpenClaw operations, particularly files not created by OpenClaw's own temp helpers.
• Process/Application: Media attachment deliveries containing content inconsistent with expected sandbox-managed files; error logs referencing path validation in sandbox-paths.ts or resolveAllowedTmpMediaPath prior to patching (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.2.24 or later, which restricts sandbox media tmp-path acceptance to OpenClaw-managed temp roots (resolvePreferredOpenClawTmpDir()) instead of the broad host os.tmpdir(). Three fix commits are included in the patch: d3da67c, 79a7b3d, and def993d. As interim mitigations, restrict what sensitive files are stored in the host temporary directory, implement access controls on the temp directory, and monitor attachment handling for suspicious file references. Plugin and extension code should use OpenClaw temp helpers (resolvePreferredOpenClawTmpDir, buildRandomTempFilePath, withTempDownloadPath) rather than raw os.tmpdir() (GitHub Advisory, Feedly).

The vulnerability was reported by researcher @tdjackey and credited in the GitHub Security Advisory. The advisory was published by steipete (an OpenClaw maintainer) on February 25, 2026, coinciding with the release of the patched version. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and patch commits (GitHub Advisory).