PT-2026-23506 · Openclaw · Openclaw

Kikayli · Published 2026-03-05 · Updated 2026-05-05 · CVE-2026-43529

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description A time-of-check-time-of-use (TOCTOU) issue exists in the validateScriptFileForShellBleed() function. A TOCTOU issue is a software bug where a system checks a condition (such as a security credential) and then uses the result of that check to perform an action, but the condition changes between the check and the use. This allows local attackers with workspace write access to bypass workspace boundary checks by using a race condition to swap the target file between the validation and preflight read phases. This causes the validator to inspect a different file identity than the one that initially passed the boundary check.

Recommendations Update to version 2026.4.10 or newer.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-43529

GHSA-GJ9Q-8W99-MP8J

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/b024fae9e5df43e9b69b2daebb72be3469d52e91 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gj9q-8w99-mp8j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gj9q-8w99-mp8j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43529 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/62333 · Note
• https://vulncheck.com/advisories/openclaw-time-of-check-time-of-use-toctou-race-condition-in-exec-script-preflight-validator · Note
• https://twitter.com/Hermes_tooll/status/2029580073289081252 · Twitter Post
• https://twitter.com/zerodaytraining/status/2029545570269085756 · Twitter Post