EUVD-2026-27269Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the target file between validation and preflight read, causing the validator to inspect a different file identity than the one that passed the initial boundary check.
AnalysisAI
OpenClaw before 2026.4.10 allows local attackers with workspace write access to bypass boundary checks via a time-of-check-time-of-use race condition in the validateScriptFileForShellBleed function. An attacker can swap the target script file between validation and preflight read, causing the validator to inspect a different file than the one that passed the initial workspace boundary check, potentially leaking preflight metadata such as matched tokens or line numbers. No public exploit code identified at time of analysis; patch available in version 2026.4.10.
Technical ContextAI
OpenClaw's exec script preflight validator performs separate validation and file-read operations on script files using mutable pathnames. The vulnerable validateScriptFileForShellBleed function first validates that a script resides within the workspace boundary, then reads and analyzes the script content by path. Because the file is accessed by pathname rather than by a pinned file descriptor, an attacker with write permissions to the workspace directory can replace the validated script file with a different file (via symlink or atomic replacement) after the boundary check but before the preflight read. The root cause (CWE-367: Improper Synchronization / Time-of-Check-Time-of-Use Race Condition) stems from the gap between checking file identity via stat() and reading the file via path-based access. The fix atomically pins the file descriptor after boundary verification, using the readFileWithinRoot helper to perform boundary checks on the opened file identity rather than relying on the mutable pathname.
RemediationAI
Upgrade to OpenClaw 2026.4.10 or newer immediately. The vendor-released patch replaces the check-then-read flow with an atomic operation using file descriptor pinning via the readFileWithinRoot helper, eliminating the TOCTOU window. Users on older versions should prioritize this upgrade since the fix involves core script execution security. No workarounds exist for versions prior to 2026.4.10 without modifying the application code. If upgrading is delayed, restrict workspace write access to trusted users only and monitor for suspicious symlink or file-replacement activity in workspace directories during script execution. See patch commit b024fae9e5df43e9b69b2daebb72be3469d52e91 and PR #62333 at https://github.com/openclaw/openclaw/pull/62333.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today