OpenClaw apply_patch Path Traversal via LLM Guardrail Bypass (CVE-2026-32060 / GHSA-r5fq-947m-xm57)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5716 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: OpenClaw Process Writes SSH Keys, Cron or Auth Config Outside Workspace (CVE-2026-32060) — Post-Exploitation

Detects the OpenClaw node process creating or modifying ~/.ssh/authorized_keys, ~/.openclaw/openclaw.json, or cron locations. These are the PoC targets for CVE-2026-32060: SSH key persistence, auth-disabling config overwrite and cron job injection through apply_patch fs.writeFile. Uses Sysmon for Linux file-create events.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1098.004, T1053.003, T1562.001
• Data sources: sysmon_for_linux, linux_auditd
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=11 (Image="*/node" OR Image="*/openclaw") (TargetFilename="*/.ssh/authorized_keys" OR TargetFilename="*/.openclaw/openclaw.json" OR TargetFilename="/etc/crontab" OR TargetFilename="/etc/cron.*" OR TargetFilename="/var/spool/cron/*") | eval technique=case(like(TargetFilename,"%authorized_keys"),"T1098.004",like(TargetFilename,"%openclaw.json"),"T1562.001",true(),"T1053.003") | stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files values(technique) as techniques by host, User, Image | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let SensitivePaths = dynamic(['/.ssh/authorized_keys', '/.openclaw/openclaw.json', '/etc/crontab', '/etc/cron.', '/var/spool/cron/']);
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ('FileCreated', 'FileModified', 'FileRenamed')
| where InitiatingProcessFileName in~ ('node', 'openclaw')
| where FolderPath has_any (SensitivePaths)
| extend Technique = case(FolderPath endswith 'authorized_keys', 'T1098.004', FolderPath has 'openclaw.json', 'T1562.001', 'T1053.003')
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, Technique, InitiatingProcessAccountName, InitiatingProcessCommandLine

Sigma

title: OpenClaw Process Modifies SSH Keys, Cron or Auth Config Outside Workspace (Splunk Primary)
id: 3c9d5a72-81b4-4f6e-a0d3-6e1b92c7f408
status: experimental
description: Detects the OpenClaw node process writing authorized_keys, openclaw.json or cron files, the PoC targets of CVE-2026-32060.
references:
  - https://github.com/openclaw/openclaw/security/advisories/GHSA-r5fq-947m-xm57
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.persistence
  - attack.t1098.004
  - attack.execution
  - attack.t1053.003
  - attack.defense-evasion
  - attack.t1562.001
  - cve.2026-32060
logsource:
  product: linux
  category: file_event
detection:
  selection_proc:
    Image|endswith:
      - '/node'
      - '/openclaw'
  selection_target_end:
    TargetFilename|endswith:
      - '/.ssh/authorized_keys'
      - '/.openclaw/openclaw.json'
      - '/etc/crontab'
  selection_target_start:
    TargetFilename|startswith:
      - '/etc/cron.'
      - '/var/spool/cron/'
  condition: selection_proc and 1 of selection_target_*
falsepositives:
  - Node-based configuration management or deployment tooling managing cron or SSH keys
  - Legitimate OpenClaw onboarding that writes its own openclaw.json
level: high

Known false positives:

• Node-based configuration management or deployment tooling managing cron or SSH keys
• Legitimate OpenClaw onboarding or CLI that writes its own openclaw.json

Tuning notes: Exclude the openclaw.json write when performed by the expected 'openclaw' CLI during known change windows. Confirm Sysmon for Linux (or auditd watches on these paths) is deployed on OpenClaw hosts. File deletions (T1070.004, T1485) are not visible via Sysmon file-create; see the KQL-002 variant or add auditd unlink rules.

• 🔒 [indicator] [indicator] Fabricated Tool History with apply_patch Traversal (Sentinel) — Exploitation · unlock with TL Creds
• 🔒 [indicator] Process Modifies or Deletes Sensitive Files Outside Workspace (Defender for Endpoint) — Post-Exploitation · unlock with TL Creds
• 🔒 SSH Key Login After [indicator] authorized_keys Modification (Sentinel) — Persistent Access · unlock with TL Creds
• 🔒 [indicator] apply_patch Traversal via Fabricated function_call History (Sigma) — Exploitation · unlock with TL Creds
• 🔒 [indicator] Process Writes authorized_keys, [indicator].json or Cron Files (Sigma) — Post-Exploitation · unlock with TL Creds
• 🔒 [indicator] Process Writes SSH authorized_keys (Sigma) — Persistent Access Precursor · unlock with TL Creds
• 🔒 [indicator] apply_patch Path Traversal via [indicator] (CVE-2026-32060) — Exploitation · unlock with TL Creds
• 🔒 SSH Public-Key Login Following [indicator] authorized_keys Write (CVE-2026-32060) — Persistent Access · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5716.

Sample indicators (1 of 8)

• File hash: 5544646a09c0121fca7d7093812dc2de8437c7f1

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

Technical analysis

Fixed in 2026.2.14.

OpenClaw is an AI agent runtime that exposes an OpenResponses-compatible HTTP API (/v1/responses) and lets the model invoke tools, including apply_patch, which applies file patches. In src/agents/apply-patch.ts, resolvePatchPath() branches on whether a sandboxRoot is configured. With a sandbox root, assertSandboxPath() blocks traversal. Without one, which is the default for native non-containerized runs, resolvePathFromCwd() calls path.resolve() and returns the result with no containment check. The resolved path goes straight to fs.writeFile and fs.rm, so ../ sequences or absolute paths in a patch hunk can write or delete files anywhere the OpenClaw process can reach.

The only effective runtime control was the LLM's own reluctance to emit a traversal path. Endor Labs (AI SAST data-flow analysis plus manual exploit development) traced the flow parsePatchText() -> hunk.path -> resolvePatchPath() -> resolvePathFromCwd() -> path.resolve(cwd, filePath) -> fs.writeFile / fs.rm. Of 10 bypass strategies tried, 9 failed (5 silent non-compliance, 3 explicit refusals, 1 path sanitization). The strategy that worked abused two design properties. First, OpenClaw implements tool_choice as a system-prompt instruction rather than a hard API constraint (openresponses-http.ts:130-165). Second, /v1/responses accepts a caller-supplied input array that may contain function_call and function_call_output items. The attacker fabricates a prior conversation in which apply_patch was already called with a traversal path and reported success. Following that in-context precedent, the model emits a real function_call with the attacker's path, and the server executes it unvalidated. Results were non-deterministic.

The researcher's validated PoC (2026-02-04) demonstrated writing an SSH public key to ~/.ssh/authorized_keys for persistent access, overwriting ~/.openclaw/openclaw.json to disable authentication, injecting cron jobs for recurring command execution, and deleting critical files. Exploitation requires a valid Bearer token for the API and apply_patch enabled, which is the default. Impact depends on who can trigger tool execution. It is highest where tool invocation is exposed to less-trusted callers or operators assumed workspace-only containment.

The fix (PR #16405, squash-merge commit 5544646a09c0121fca7d7093812dc2de8437c7f1, released as 2026.2.14) reuses the sandbox path guard for non-sandbox resolution and enforces workspace-root bounds, rejecting relative traversal, absolute paths outside the workspace and symlink escapes. The advisory documents tools.exec.applyPatch.workspaceOnly (default true) as the control; setting it to false deliberately disables containment. The GitHub advisory (GHSA-r5fq-947m-xm57) lists no CVE. The CVE-2026-32060 identifier was published 2026-03-11 and maps to the same flaw (OpenClaw < 2026.2.14). A separate apply_patch bypass in opt-in sandbox mounts (GHSA-h9xm-j4qg-fvpg / CVE-2026-32007, fixed in 2026.2.23) is a different issue. No in-the-wild exploitation, threat actor or network infrastructure is reported in the sources.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051 LLM Prompt Injection; AML.T0053 AI Agent Tool Invocation; T1053.003 Cron

Defense Evasion

AML.T0054 LLM Jailbreak; T1070.004 File Deletion

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098.004 SSH Authorized Keys

Impact

T1485 Data Destruction

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• openclaw >= 2026.2.14 (PR #16405, commit 5544646a09c0121fca7d7093812dc2de8437c7f1)

Immediate actions

• Upgrade openclaw to 2026.2.14 or later (2026.2.23+ also addresses the related sandbox-mount apply_patch bypass CVE-2026-32007)
• Restrict which principals hold Bearer tokens for /v1/responses and rotate tokens that may have been exposed
• Audit ~/.ssh/authorized_keys, ~/.openclaw/openclaw.json, user crontabs and cron directories on hosts running vulnerable OpenClaw for unexpected changes

Workarounds

• Set tools.exec.applyPatch.enabled: false if apply_patch is not needed
• Keep tools.exec.applyPatch.workspaceOnly at its default of true
• Restrict who can trigger tool execution and which tools are allowlisted

Longer-term hardening

• Run OpenClaw in Docker with sandboxRoot configured so assertSandboxPath() enforces containment
• Do not treat LLM refusal behavior as a security control; enforce path, tool and argument validation server-side
• Run the OpenClaw process as a low-privilege user with a restricted filesystem view

Affected and fixed versions

• OpenClaw — openclaw (npm)
  Vulnerable versions: <= 2026.2.13
  Fixed in: 2026.2.14

Timeline

• 2026-02-03 Endor Labs AI SAST data-flow analysis flags path traversal in OpenClaw apply_patch (non-sandboxed path resolution).
• 2026-02-04 Working PoC validated using fabricated function_call/function_call_output history via /v1/responses: SSH key injection, auth-disabling config overwrite, cron injection and file deletion.
• 2026-02-05 Vulnerability reported to OpenClaw maintainers (advisory credits reporter @p80n-sec).
• 2026-02-14 PR #16405 squash-merged (commit locked-ioc-1); openclaw 2026.2.14 released with workspace containment for non-sandbox apply_patch.
• 2026-02-19 GitHub advisory GHSA-r5fq-947m-xm57 published (High, CVSS 3.1 8.8, CWE-22); Endor Labs publishes technical write-up.
• 2026-02-23 Related apply_patch bypass in opt-in sandbox mounts (GHSA-h9xm-j4qg-fvpg / CVE-2026-32007) fixed in 2026.2.23.
• 2026-03-11 CVE-2026-32060 published for OpenClaw < 2026.2.14 apply_patch path traversal (CVSS v3 8.8, v4 8.7).

Sources cited

• GHSA-r5fq-947m-xm57: Path traversal in apply_patch could write/delete files outside the workspace GitHub · Advisory · 2026-02-19
• Tenable: CVE-2026-32060 Tenable · Advisory · 2026-03-11
• VulnCheck: OpenClaw path traversal in apply_patch via crafted paths vulncheck.com · Advisory · 2026-03-11
• ENISA EUVD-2026-11150 euvd.enisa.europa.eu · Advisory · 2026-03-11
• GitLab Advisory Database: GHSA-r5fq-947m-xm57 (npm openclaw) GitLab · Advisory · 2026-02-19
• Positive Technologies dbugs PT-2026-24670 dbugs.ptsecurity.com · Advisory · 2026-03-11
• AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass (Endor Labs) endorlabs.com · Research · 2026-02-19
• Related: GHSA-h9xm-j4qg-fvpg / CVE-2026-32007 apply_patch sandbox-mount bypass miggo.io · Research · 2026-02-23
• OpenClaw PR #16405: enforce workspace bounds for apply_patch in non-sandbox mode GitHub · Code repository · 2026-02-14
• OpenClaw fix commit 5544646a09c0121fca7d7093812dc2de8437c7f1 GitHub · Code repository · 2026-02-14

More in vulnerability

• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)

Previous and next in vulnerability

• Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194) Previous report
• Six OpenClaw Vulnerabilities (SSRF, Webhook Auth Bypass, Path Traversal) incl. CVE-2026-26322, CVE-2026-26319, CVE-2026-26329 Next report

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks