sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-32977 OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path

Medium 5.8 Published Updated

Attackers can bypass sandbox boundaries via a race condition in file commits, potentially executing code or escalating privileges outside the container.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Local or same network only
Victim action needed
Not needed
Fix
Available

What is CVE-2026-32977?

CVE-2026-32977 is a medium-severity vulnerability in Openclaw Openclaw, published on 31 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox to redirect committed files outside the validated writable path within the container mount namespace.

Weakness: CWE-367

Which versions are affected by CVE-2026-32977?

2 open source packages ship an affected version, including openclaw. It affects 1 product.

PackageAffectedFixed in
openclaw npmAll versions2026.3.11
openclaw npmAll versions2026.3.11

Products include Openclaw Openclaw.

How do I fix CVE-2026-32977?

Upgrade openclaw to 2026.3.11 or later.

Is CVE-2026-32977 being exploited?

There is no known exploitation of CVE-2026-32977 in the wild and no public exploit code.

All Openclaw Openclaw vulnerabilities

Sources

Also known as GHSA-xvx8-77m6-gwg6, MINI-2m9x-35vw-x9c7, MINI-65w2-fgcm-hf2v.

Is CVE-2026-32977 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free