EUVD-2026-28190Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.22.
DescriptionCVE.org
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.
AnalysisAI
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows authenticated attackers to redirect file writes outside the intended mount root via symlink swaps. By exploiting the window between sandbox validation and actual file write operations, an attacker with local access can manipulate symlinks to bypass sandbox filesystem restrictions and write arbitrary files to locations outside the workspace.
Technical ContextAI
OpenClaw's OpenShell component implements a filesystem bridge (fs-bridge.ts) that mediates write operations between a sandboxed container and the host filesystem. The vulnerability stems from CWE-367 (time-of-check/time-of-use race condition) in the writeFile method, which previously created a temporary file in the parent directory, then atomically renamed it to the target path. An attacker could exploit the interval between the directory traversal check and the rename operation by swapping symlinks, redirecting the write to a parent-relative path outside the mountHostRoot boundary. The fix implements root-scoped validation by calling writeFileWithinRoot, which verifies the canonical target path against the mount root before performing any filesystem operations and rejects writes attempting to traverse symlink parents or target symlinks.
RemediationAI
Upgrade OpenClaw to version 2026.4.22 or later by running 'npm install openclaw@2026.4.22' or updating package.json and reinstalling. The patch is confirmed published on npm and contained in the v2026.4.22 git tag (commit 7be82d4fd1193bcb7e44ee38838f00bf924ffa76). No interim workarounds are available without code patching. For environments unable to update immediately, restrict filesystem write permissions within OpenClaw sandbox workspaces to non-symlink paths and monitor for suspicious symlink creation in workspace directories, though this is not a robust compensating control. Verify the fix by checking that openclaw@2026.4.22 is installed and confirming the fs-bridge.ts file imports and uses writeFileWithinRoot from the plugin SDK. Refer to the GitHub advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-wppj-c6mr-83jj for additional verification steps.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today