Executive brief
OpenClaw is a library that provides a filesystem bridge for sandboxed operations. A vulnerability in this component allows an attacker to bypass security restrictions and read sensitive files from the underlying host system that should be inaccessible. This could lead to the exposure of private configuration files, credentials, or other internal data, potentially compromising the entire server environment.
Technical details
A time-of-check/time-of-use (TOCTOU) race condition exists in the OpenShell filesystem bridge of OpenClaw before version 2026.4.22. The vulnerability occurs because the system verifies a file's location before reading it, but does not prevent the file path from being modified (e.g., via a symlink swap) between the verification and the actual read operation. An attacker with low privileges can exploit this race condition over the network to bypass sandbox restrictions and access unauthorized files outside the designated mount root. The fix introduces 'no-follow' semantics during file opens, validates pinned file descriptors against the canonical mount root, and implements a strict ancestor walk on platforms lacking file-descriptor path readback.
Affected products
- openclaw openclaw < 2026.4.22
Timeline
- 2026-04-22: patched: Fix committed in version 2026.4.22
- 2026-05-06: disclosed: Initial advisory published
- 2026-05-11: other: Advisory withdrawn as a duplicate of GHSA-5h3g-6xhh-rg6p