OpenClaw CVE-2026-41296

Exploitation requires authenticated access with low privileges (PR:L) to OpenClaw's remote filesystem bridge component specifically. The vulnerability affects deployments where the remote filesystem bridge is enabled and accessible over the network (AV:N), which may not be default configuration for all OpenClaw installations. High attack complexity (AC:H) indicates successful exploitation demands precise timing to win the TOCTOU race between path validation and file read operations, likely requiring automated tools to generate rapid concurrent requests. The separate validation and read operations must execute with sufficient delay to create an exploitable race window, which may depend on system load, filesystem performance, or network latency. No user interaction required (UI:N), but the attacker must already possess valid credentials for the remote filesystem service. Limiting exploitation: authentication barrier prevents unauthenticated remote attacks, high complexity makes casual exploitation unlikely, and successful sandbox escape may require multiple attempts to reliably win the race condition, potentially generating detectable anomalous request patterns in logs.

Real-world risk is moderate despite high CVSS 8.8 scoring. The CVSS vector's AC:H (high attack complexity) reflects the precise timing required to win the race condition, making exploitation non-trivial and likely requiring multiple attempts or specific environmental conditions. EPSS score of 0.03% (7th percentile) indicates security researchers assess low near-term exploitation probability, consistent with the technical difficulty and niche attack surface of a gaming engine's remote filesystem bridge. No CISA KEV listing and no public POC identified at time of analysis suggest this remains a theoretical vulnerability. However, the scope change indicators (SC:H/SI:H) showing high subsequent system impact elevate severity - successful exploitation breaks out of the sandbox entirely, not just compromising the vulnerable component. Authentication requirement (PR:L) provides some defense-in-depth, limiting attack surface to users with existing remote filesystem bridge access. Priority should focus on environments where OpenClaw runs with elevated privileges or processes sensitive data, particularly if the remote filesystem bridge is exposed to untrusted networks. The availability of a vendor patch (commit 121870a) shifts this from emergency to planned maintenance priority unless OpenClaw is deployed in high-risk contexts.

An authenticated attacker with low-privilege access to OpenClaw's remote filesystem bridge initiates multiple concurrent readFile requests targeting a sensitive system file (e.g., /etc/shadow or application configuration). During the first request, the attacker provides a legitimate path that passes sandbox validation. Exploiting the race window between validation and file read, the attacker rapidly replaces the validated path with a symbolic link or performs a filesystem manipulation pointing to the restricted target file. Due to high attack complexity (AC:H), the attacker likely automates this process with repeated attempts until successfully winning the race condition. Upon successful exploitation, the attacker reads arbitrary files outside the sandbox, exfiltrating credentials, configuration secrets, or other sensitive data, then potentially modifies files (VI:H) to establish persistence or further compromise the system.