Threat video1:00
CVE-2026-32060 OpenClaw Path Traversal: Detection & IOCs
Fabricated function_call entries let OpenClaw's apply_patch escape the workspace. 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-32060 OpenClaw Path Traversal: Detection & IOCs →
Chapters
- 0:00The hookAuthenticated callers could write files outside workspace.
- 0:04The storyEndor Labs flagged it in February.
- 0:11Attack pathPath traversal in an authenticated file tool.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise6 indicators to hunt: 1 SHA-1 hash, 1 package name and 4 paths.
- 0:38MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:43Remediation10 remediation steps are listed, 3 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Authenticated callers could write files outside workspace.
0:05Endor Labs flagged it in February.
0:07Fixed on February 14.
0:11Path traversal in an authenticated file tool.
0:14Without a sandbox, paths had no containment.
0:17Attackers could plant SSH keys, disable auth, delete files.
0:22Upgrade OpenClaw now.
0:26No threat actor is attributed. Confidence: low.
0:316 indicators to hunt: 1 SHA-1 hash, 1 package name and 4 paths.
0:387 ATT&CK techniques, from initial access to impact.
0:4310 remediation steps are listed, 3 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.