CVE-2026-44112

CRITICAL

OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes
https://www.vulncheck.com/advisories/openclaw-symlink-swap-race-condition-in-openshell-fs-bridge-writes
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-wppj-c6mr-83jj)
https://github.com/openclaw/openclaw/security/advisories/GHSA-wppj-c6mr-83jj

Scores

CVSS v3 9.6
EPSS 0.0003
EPSS Percentile 9.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-367
Status published
Products (4)
npm/openclaw 0 - 2026.4.22npm
OpenClaw/OpenClaw < 2026.4.22
openclaw/openclaw < 2026.4.22
OpenClaw/OpenClaw 2026.4.22
Published May 06, 2026
Tracked Since May 07, 2026