CVE-2026-32055: Openclaw

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace through in-workspace symlinks pointing to non-existent out-of-root targets. The vulnerability exists because the boundary check improperly resolves aliases, permitting the first write operation to escape the workspace boundary and create files in arbitrary locations.

Affected products

• Openclaw Openclaw: before 2026.2.26 (fixed in 2026.2.26)

Published 2026-03-21. Last modified 2026-06-17.