PT-2026-33863 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-03 · Updated 2026-04-21 · CVE-2026-41296

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A time-of-check-time-of-use (TOCTOU) race condition exists in the remote filesystem bridge readFile() function. This occurs because path validation and file read operations are performed separately, allowing attackers to bypass sandbox restrictions and read arbitrary files, resulting in a sandbox escape.

Recommendations Update to version 2026.3.31 or later.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-41296

GHSA-9P3R-HH9G-5CMG

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-9p3r-hh9g-5cmg · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/121870a08583033ed6a0ed73d9ffea32991252bb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41296 · Security Note
• https://osv.dev/vulnerability/GHSA-9p3r-hh9g-5cmg · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://twitter.com/VulmonFeeds/status/2046469457480921238 · Twitter Post
• https://vulncheck.com/advisories/openclaw-sandbox-escape-via-toctou-race-in-remote-fs-bridge-readfile · Note
• https://twitter.com/CVEnew/status/2046571883659989205 · Twitter Post