CVE-2026-32060: Openclaw

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.

Affected products

• Openclaw Openclaw: before 2026.2.14 (fixed in 2026.2.14)

Published 2026-03-11. Last modified 2026-06-17.