Which versions of OpenClaw are affected by CVE-2026-41296?

OpenClaw versions before 2026.3.31 contain a sandbox escape vulnerability allowing authenticated users to read arbitrary files on the host system through a race condition in the filesystem bridge,…. A patch is available.

How to fix or mitigate CVE-2026-41296?

Within 24 hours: Identify all OpenClaw installations and confirm which versions are deployed (target versions before 2026.3.31); disable or restrict network access to affected OpenClaw instances to only trusted internal users. Within 7 days: Implement application-level access controls to limit authenticated user permissions; review application logs for suspicious file access patterns; consider air-gapping or containerizing OpenClaw instances with strict host filesystem restrictions. Within 30 days: Monitor OpenClaw vendor advisories for patch availability; evaluate alternative products if patch timeline is uncertain; conduct access review of all accounts with OpenClaw credentials.

OpenClaw CVE-2026-41296

Q: What is the CVSS score of CVE-2026-41296?

CVE-2026-41296 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-04-21 disclosure@vulncheck.com

GHSA-9p3r-hh9g-5cmg

Authentication Bypass Openclaw

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 21, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 00:38 vuln.today

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to bypass sandbox restrictions and read arbitrary files.

AnalysisAI

Remote filesystem bridge in OpenClaw (<2026.3.31) enables sandbox escape through a TOCTOU race condition in readFile validation. Authenticated remote attackers can exploit the timing gap between path validation and file read operations to bypass sandbox restrictions and access arbitrary files outside the intended security boundary, potentially compromising both confidentiality and integrity of the underlying system. EPSS score of 0.03% (7th percentile) suggests low probability of widespread exploitation despite CVSS 8.8 severity, though patch availability from vendor (commit 121870a) enables defenders to remediate proactively before active exploitation begins.

Technical ContextAI

This vulnerability stems from CWE-367 (Time-of-Check-Time-of-Use race condition) in OpenClaw's remote filesystem bridge component. The readFile function performs path validation as a separate step from the actual file read operation, creating a race window where an attacker can substitute a validated safe path with a malicious one between the check and use phases. This classic TOCTOU flaw undermines the sandbox security model by allowing symbolic link attacks, path traversal, or file replacement techniques to bypass intended filesystem isolation. The CVSS 4.0 vector indicates network attack vector with high attack complexity (AV:N/AC:H), requiring low privileges (PR:L) but no user interaction (UI:N), with high impact to both vulnerable and subsequent system confidentiality and integrity (VC:H/VI:H/SC:H/SI:H). The remote filesystem bridge likely supports distributed file operations or remote debugging capabilities, making the sandbox boundary a critical security control.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later, which contains the fix for the TOCTOU race condition per vendor advisory GHSA-9p3r-hh9g-5cmg and commit 121870a08583033ed6a0ed73d9ffea32991252bb on GitHub. The patch likely implements atomic file operations or file descriptor-based access to eliminate the race window between validation and read operations. If immediate upgrade is not feasible, disable the remote filesystem bridge component entirely if not required for operations - this eliminates the attack surface but will break any workflows dependent on remote file access capabilities, requiring alternative file transfer mechanisms. For deployments requiring the bridge, restrict network access to the remote filesystem service to trusted IP ranges only and enforce principle of least privilege for accounts with bridge access (PR:L requirement). Implement file integrity monitoring on sensitive directories to detect successful sandbox escapes post-exploitation, though this provides detection rather than prevention. Review application logs for anomalous readFile patterns showing rapid repeated requests to the same paths, which may indicate race condition exploitation attempts. Note that authentication-based mitigations provide limited value since the vulnerability is exploitable by authenticated users (PR:L).