by Kastro
Paper/Archive/CVE-2026-44112

CVE-2026-44112

OpenClaw OpenClaw — OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes

EPSS 7%CVSS 9.6
critical.is priorityof 100
48
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 94.4.944 × 2018.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.4.222026.4.22CNA

Scores by source

VulnCheck (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
VulnCheck (CNA)8.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-wppj-c6mr-83jjpatchgithub.com/openclaw/openclaw/commit/7be82d4fd1193bcb7e44ee38838f00bf924ffa76writeupvulncheck.com/advisories/openclaw-symlink-swap-race-condition-in-openshell-fs-bridge-writes