CVE-2026-32988: OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unvalidated Temporary File Creation

Published Mar 31, 2026
·
Updated

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinned to a verified parent directory. Attackers can exploit a race condition in parent-path alias changes to write attacker-controlled bytes outside the intended validated path before the final guarded replace step executes.

Affected Software

2 affected components
OpenClaw OpenClaw<2026.3.11
OpenClaw Openclaw Node.js<2026.3.11

Event History

Mar 31, 2026
CVE Published
via MITRE·11:17 AM
Data Sourced
via MITRE·11:17 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-32988?

CVE-2026-32988 is classified as a medium severity vulnerability due to its potential for sandbox boundary bypass.

2

How can I fix CVE-2026-32988?

To fix CVE-2026-32988, update OpenClaw to version 2026.3.11 or later, which addresses the sandbox boundary bypass issue.

3

What systems are affected by CVE-2026-32988?

The affected version of OpenClaw is any version prior to 2026.3.11.

4

What does CVE-2026-32988 exploit?

CVE-2026-32988 exploits unvalidated temporary file creation to bypass sandbox boundaries in OpenClaw.

5

What is the impact of CVE-2026-32988?

The impact of CVE-2026-32988 allows attackers to create files outside of a verified parent directory, potentially leading to privilege escalation.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203