EUVD-2026-28192Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.22.
DescriptionCVE.org
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.
AnalysisAI
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use (TOCTOU) race condition in the OpenShell filesystem bridge that allows authenticated attackers with local access to read files outside the intended mount root by performing symlink swaps during filesystem operations. The vulnerability affects sandbox security guarantees by enabling bypass of containment restrictions through coordinated symlink manipulation, and has been confirmed patched in version 2026.4.22.
Technical ContextAI
The OpenShell filesystem bridge in OpenClaw implements a sandbox layer that restricts file access to specific mount roots. The vulnerability exists in the file read path where the bridge performed path safety validation (time-of-check) followed by a separate file open and read operation (time-of-use), creating a TOCTOU window. An attacker could swap symlinks in parent directories between validation and the actual file access, redirecting reads to arbitrary files outside the sandbox boundary. The root cause is CWE-367 (Time-of-check/Time-of-use Race Condition). The fix addresses this by pinning file descriptors immediately after opening (using O_NOFOLLOW semantics where available), validating against the canonical mount root using kernel-backed fd-path readback, and implementing a strict ancestor chain walk on platforms lacking fd-path support (macOS, Windows) to prevent parent-directory symlink races.
RemediationAI
Vendor-released patch: OpenClaw 2026.4.22. Upgrade immediately to 2026.4.22 or later. Run npm update openclaw or npm install openclaw@2026.4.22 to pull the patched version. The fix is confirmed published on npm and contains the full mitigation code that pins file descriptors, validates against canonical roots, and implements ancestor chain checks. No workarounds are available for prior versions - the TOCTOU window is fundamental to the old implementation. If immediate upgrade is not possible, restrict access to OpenShell containers and disable filesystem bridge features that are not required, though this provides only partial mitigation and is not a substitute for patching.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today