OpenClaw CVE-2026-41364

Exploitation requires valid SSH authentication credentials to an OpenClaw instance (CVSS PR:L indicates low-privileged authenticated access is sufficient). The SSH sandbox tar upload feature must be enabled and accessible to the authenticated user - if this feature is disabled or restricted to administrators only, the vulnerability cannot be exploited. The OpenClaw process must have sufficient filesystem permissions to write to the symlink target locations for the attack to succeed - targeting system directories like /etc requires the service to run with elevated privileges. The vulnerability affects network-accessible deployments (AV:N) with default or permissive sandbox configurations that do not employ additional symlink protection mechanisms such as chroot jails, bind mounts with nosymfollow options, or secure extraction libraries that refuse to follow symlinks outside extraction boundaries.

The CVSS 4.0 score of 7.2 reflects HIGH integrity and availability impact with NETWORK attack vector, LOW complexity, and LOW privileges required. The vulnerability requires authenticated access (PR:L) but no user interaction (UI:N), making it straightforward to exploit once credentials are obtained. Scope is UNCHANGED, meaning the impact is confined to the vulnerable component itself. While no public exploit has been identified and the CVE is not listed in CISA KEV, the technical simplicity of symlink attacks (readily achievable with standard tar command-line tools) makes this easily reproducible. The primary risk is to organizations running OpenClaw with SSH sandbox features enabled and exposed to authenticated users who may be compromised or malicious insiders. Real-world priority is MEDIUM-HIGH for affected deployments: the attack is simple and the impact severe (arbitrary file write can lead to configuration tampering, code execution via overwriting scripts/binaries, or denial of service), but exploitation requires valid authentication and the specific SSH sandbox tar upload feature must be in use. Organizations not using this feature or restricting SSH access to highly trusted users face lower practical risk despite the high CVSS score.

An attacker with valid SSH credentials to an OpenClaw instance crafts a malicious tar archive containing a symbolic link named 'config' pointing to '/etc/cron.d/backdoor' and a regular file that will be extracted following that symlink. Upon uploading this archive to the SSH sandbox, OpenClaw extracts the contents without validating the symlink target. The application follows the symlink and writes the attacker's malicious cron job file to /etc/cron.d/backdoor, establishing persistent code execution. Alternatively, the attacker could target application configuration files, SSH authorized_keys, or systemd service definitions to achieve similar privilege escalation or persistence goals.