Every CVE Search/ Get API key

CVE-2026-32007

OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass

7.6 HighFix available

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply_patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.39%Up 0.4 points since Mar 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.6

OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply_patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Record
CVE-2026-32007
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-13265 7.6

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply_patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Record
EUVD-2026-13265
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h9xm-j4qg-fvpg 7.6

OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)

Summary

In some opt-in sandbox configurations, the experimental apply_patch tool did not consistently apply workspace-only checks to mounted paths (for example /agent/...).

Impact

This does not affect default installs.

Default posture:

  • agents.defaults.sandbox.mode=off (sandbox disabled by default)
  • tools.exec.applyPatch.enabled=false (experimental tool disabled by default)

This behavior applies only when all of the following are enabled/configured:

  • sandbox mode,
  • experimental apply_patch,
  • workspace-only expectations (tools.fs.workspaceOnly=true and/or tools.exec.applyPatch.workspaceOnly=true),
  • and writable mounts outside workspace.

Under that opt-in setup, apply_patch operations could target mounted paths outside the workspace root.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected published versions: <= 2026.2.22-2
  • Fixed in code on main: commit 6634030be31e1a1842967df046c2f2e47490e6bf
  • Patched release: 2026.2.23

Technical Details

In the sandbox path flow, apply_patch used sandbox.bridge.resolvePath(...) without applying the same workspace-root assertion used by other filesystem tools. The fix makes apply_patch follow the same workspace-only enforcement for sandbox-resolved paths (unless explicitly disabled with tools.exec.applyPatch.workspaceOnly=false).

Fix Commit(s)

  • 6634030be31e1a1842967df046c2f2e47490e6bf

Release Process Note

patched_versions is pre-set to the released version (2026.2.23). Patched in 2026.2.23 and published.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-h9xm-j4qg-fvpg
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22, CWE-284, CWE-863
Updated
2026-11-02
NVD 7.6

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply_patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Record
CVE-2026-32007
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 7.6

OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent enforcement of workspace-only checks on mounted paths. Attackers can use apply_patch operations on writable mounts outside the workspace root to access and modify arbitrary files on the system.

Record
CVE-2026-32007
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-h9xm-j4qg-fvpg 7.6

OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)

Summary

In some opt-in sandbox configurations, the experimental apply_patch tool did not consistently apply workspace-only checks to mounted paths (for example /agent/...).

Impact

This does not affect default installs.

Default posture:

  • agents.defaults.sandbox.mode=off (sandbox disabled by default)
  • tools.exec.applyPatch.enabled=false (experimental tool disabled by default)

This behavior applies only when all of the following are enabled/configured:

  • sandbox mode,
  • experimental apply_patch,
  • workspace-only expectations (tools.fs.workspaceOnly=true and/or tools.exec.applyPatch.workspaceOnly=true),
  • and writable mounts outside workspace.

Under that opt-in setup, apply_patch operations could target mounted paths outside the workspace root.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected published versions: <= 2026.2.22-2
  • Fixed in code on main: commit 6634030be31e1a1842967df046c2f2e47490e6bf
  • Patched release: 2026.2.23

Technical Details

In the sandbox path flow, apply_patch used sandbox.bridge.resolvePath(...) without applying the same workspace-root assertion used by other filesystem tools. The fix makes apply_patch follow the same workspace-only enforcement for sandbox-resolved paths (unless explicitly disabled with tools.exec.applyPatch.workspaceOnly=false).

Fix Commit(s)

  • 6634030be31e1a1842967df046c2f2e47490e6bf

Release Process Note

patched_versions is pre-set to the released version (2026.2.23). Patched in 2026.2.23 and published.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-h9xm-j4qg-fvpg
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22, CWE-284, CWE-863
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 before 2026.2.23
2026.2.23

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32007 is a high vulnerability (CVSS 7.6) in Openclaw, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in openclaw 2026.2.23.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open