CVE-2026-32007: Openclaw

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply_patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Affected products

• Openclaw Openclaw: before 2026.2.23 (fixed in 2026.2.23)

Published 2026-03-19. Last modified 2026-06-17.