CVE-2026-32022 OpenClaw CVE debrief

Who should care

Organizations running OpenClaw versions prior to 2026.2.21 in production environments, particularly those processing untrusted input or operating in multi-tenant contexts where file isolation is critical. Security teams should prioritize patching if OpenClaw is exposed to potentially malicious input or if sensitive configuration files exist in accessible working directories.

Technical summary

The vulnerability exists in OpenClaw's tools.exec.safeBins implementation of the grep tool. The intended security policy restricts grep to stdin-only operations, preventing direct file access. However, the implementation fails to properly validate command-line arguments when the -e flag is used to specify a pattern. An attacker can supply a pattern via -e and append a filename as a positional operand, causing grep to read from the specified file rather than stdin. This bypasses the stdin-only restriction and allows arbitrary file read from the working directory, including sensitive files like .env. The root cause is incomplete input validation (CWE-184) where the argument parser does not reject or sanitize unexpected filename operands when the -e flag is present.

Defensive priority

medium

Recommended defensive actions

• Upgrade OpenClaw to version 2026.2.21 or later to obtain the patch
• Review and audit tools.exec.safeBins configurations for additional policy enforcement gaps
• Implement defense-in-depth by restricting file system access for OpenClaw processes using containerization or sandboxing
• Monitor for suspicious grep invocations with -e flags followed by positional filename arguments
• Validate that custom tool wrappers properly sanitize or reject unexpected filename operands
• Review application logs for unauthorized file access attempts in OpenClaw working directories

Evidence notes

The vulnerability is classified as CWE-184 (Incomplete List of Disallowed Inputs). The CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and high confidentiality impact. The affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* with versions prior to 2026.2.21 being vulnerable.

Official resources