OpenClaw CVE-2026-100597

Exploitation requires local access to a system running OpenClaw and the ability to invoke or influence OpenShell 'local mirror' filesystem mutation operations (remove, mkdir, or rename) - this is the specific feature at risk. The attacker must be able to concurrently change the target path (e.g., swap a file/directory or symlink) during the narrow window between OpenClaw's sandbox path-safety check and the actual operation, i.e., win the TOCTOU race (CVSS AC:H, AT:P). Privileges required are low (PR:L). Critically, exploitation does NOT require the operator to have granted host filesystem access outside the sandbox, so default sandboxed deployments are affected. Limiting factors: local vector only (no network reach), the high-complexity timing race that must be won reliably, and impact bounded by the permissions of the OpenClaw process user.

This is a genuine sandbox-escape flaw whose real-world risk is moderated by non-trivial exploitation preconditions. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L) makes clear this is NOT a remote, drive-by issue: the attacker needs local access, low-privilege ability to influence the filesystem OpenClaw operates on, and must win a timing race (AC:H plus AT:P) between OpenClaw's path-safety check and the actual remove/mkdir/rename operation. Against that, the impact metrics are maximal (VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H), reflecting that a successful race lets a sandboxed operation mutate host paths OUTSIDE the intended mirror root - a true confinement breakout. No EPSS score, CISA KEV entry, or public POC was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - treat the 8.8 as a capability ceiling, not evidence of active use. The notable signal that elevates priority above a typical local race is the description's explicit statement that exploitation 'does not require an operator to have granted host filesystem access outside the sandbox' - the security boundary users rely on can be bypassed without any misconfiguration. Net: a real, patch-worthy issue for anyone running untrusted or multi-tenant workloads through OpenClaw's OpenShell, but the AC:H/AT:P race condition means opportunistic mass exploitation is unlikely; realistic threat is a determined local/adjacent-code attacker.

An attacker with low-privilege ability to run or influence code alongside OpenClaw submits a sandboxed remove/mkdir/rename against a path inside the mirror root, then concurrently swaps that path (e.g., via a symlink or directory rename) after OpenClaw's safety check passes but before the operation executes. Winning this race causes OpenClaw to delete, create, or rename a host file outside the sandbox with the process user's permissions. No public exploit code was identified in the provided intelligence, and success depends on reliably winning the TOCTOU window (CVSS AC:H/AT:P).