Which versions of OpenClaw are affected by CVE-2026-41364?

CVE-2026-41364 affects OpenClaw servers prior to version 2026.3.31, allowing authenticated users to bypass sandbox controls and overwrite arbitrary system files through malicious tar archives,…. A patch is available.

How to fix or mitigate CVE-2026-41364?

Within 24 hours: Identify all OpenClaw servers running versions before 2026.3.31 and document current version inventory. Within 7 days: Implement strict access controls to OpenClaw SSH sandbox features, restrict tar archive uploads to trusted administrators only, and monitor file modification events on critical system directories. Within 30 days: Contact OpenClaw vendor for patch availability status and timeline; if patch releases, prioritize immediate deployment to all affected instances.

OpenClaw CVE-2026-41364

Q: What is the CVSS score of CVE-2026-41364?

CVE-2026-41364 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-04-28 disclosure@vulncheck.com

Information Disclosure Openclaw

7.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 16:37 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 00:31 vuln.today

Analysis Generated

Apr 28, 2026 - 00:22 vuln.today

CVE Published

Apr 28, 2026 - 00:16 nvd

HIGH 7.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox and overwrite files on the remote host.

AnalysisAI

Remote authenticated attackers can overwrite arbitrary files on OpenClaw servers by uploading malicious tar archives containing symbolic links to the SSH sandbox feature. The vulnerability allows escaping sandbox restrictions to modify critical system files, enabling potential remote code execution or denial of service. Affects OpenClaw versions before 2026.3.31. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE.

Technical ContextAI

This is a classic symlink following vulnerability (CWE-59) in OpenClaw's SSH sandbox tar archive handling mechanism. When processing uploaded tar archives, the application fails to properly validate or sanitize symbolic links before extraction. An attacker can craft a tar archive where a symlink points outside the intended sandbox directory (e.g., pointing to /etc/passwd or application configuration files). During extraction, the application follows the symlink and writes attacker-controlled content to the symlink target location rather than within the sandbox boundary. This class of vulnerability is common in archive extraction routines that don't use secure extraction libraries or fail to check for path traversal sequences and symbolic link targets. The SSH sandbox context suggests this feature is designed for remote file transfer or deployment operations, making it an attractive target for authenticated attackers seeking privilege escalation or persistence mechanisms.

RemediationAI

Upgrade to OpenClaw version 2026.3.31 or later, which contains a fix for the symlink following vulnerability as documented in GitHub commit 3d5af14984ac1976c747a8e11581d697bd0829dc available at https://github.com/openclaw/openclaw/commit/3d5af14984ac1976c747a8e11581d697bd0829dc. Organizations unable to immediately upgrade should implement compensating controls: disable the SSH sandbox tar upload feature entirely if not operationally required; restrict SSH access to the OpenClaw service to only highly trusted administrative accounts using IP allowlisting and strong authentication (certificate-based rather than password); implement file integrity monitoring on critical system paths to detect unauthorized modifications; and deploy the application in containerized or virtualized environments with read-only root filesystems where possible to limit the impact of arbitrary file writes. Note that disabling tar upload may break deployment workflows, and restrictive access controls must be balanced against operational needs for legitimate file transfers.