PT-2026-26389 · Openclaw · Openclaw

Tdjackey · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-32007

Mitre

CVSS v3.1

6.8

Medium

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32007

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/6634030be31e1a1842967df046c2f2e47490e6bf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32007 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h9xm-j4qg-fvpg · Note
• https://vulncheck.com/advisories/openclaw-sandbox-bypass-in-apply-patch-tool-via-workspace-only-check-bypass · Note