What is the CVSS score of CVE-2026-32060?

CVE-2026-32060 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Openclaw are affected by CVE-2026-32060?

OpenClaw versions before 2026.2.14 contain a critical vulnerability allowing attackers to write or delete files outside intended directories, potentially compromising system integrity and data…. A patch is available.

How to fix or mitigate CVE-2026-32060?

Within 24 hours: Inventory all systems running OpenClaw and identify affected versions; implement network segmentation to restrict OpenClaw access to trusted networks only. Within 7 days: Disable the apply_patch functionality if operationally feasible; implement file integrity monitoring on critical system directories; escalate vendor for patch timeline. Within 30 days: Apply vendor patch immediately upon release; conduct forensic review of file system access logs for unauthorized modifications.

Openclaw CVE-2026-32060

HIGH

Path Traversal (CWE-22)

2026-03-11 disclosure@vulncheck.com

GHSA-r5fq-947m-xm57

Path Traversal Openclaw

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 14:16 nvd

HIGH 8.8

DescriptionCVE.org

OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.

AnalysisAI

OpenClaw versions before 2026.2.14 allow authenticated attackers to bypass filesystem restrictions in the apply_patch function through path traversal, enabling arbitrary file write and deletion operations outside the intended workspace. The vulnerability requires an authenticated user but no additional user interaction, and affects systems with apply_patch enabled without sandbox containment. No patch is currently available.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects OpenClaw. OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.