by Kastro
Paper/Archive/CVE-2026-41397

CVE-2026-41397

OpenClaw OpenClaw — OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal

EPSS 0.5%CVSS 9.6
critical.is priorityof 100
37
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 40.7.407 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions by crafting malicious symlinks in mirror sync operations to access arbitrary files outside intended boundaries.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.3.312026.3.31CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
VulnCheck (CNA)7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-cwf8-44x6-32c2patchgithub.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1patchgithub.com/openclaw/openclaw/commit/3b9dab0ece4643a9643e6a45459f5c709d3ce320writeupvulncheck.com/advisories/openclaw-sandbox-escape-via-unrestricted-file-sync-and-symlink-traversal