CVE-2026-100597 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safety check, if the path is changed concurrently. An attacker able to win the race can cause a sandboxed operation to delete, create, or rename a host path outside the intended mirror root with the permissions of the OpenClaw process user. This does not require an operator to have granted host filesystem access outside the sandbox. The issue is fixed in 2026.7.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in versions of the openclaw npm package prior to release 2026.7.1 represents a critical security flaw rooted in time-of-check to time-of-use race conditions within its OpenShell local mirror filesystem mutation operations. This class of vulnerability arises when there is an interval between the verification of a condition and the subsequent use of that verified state, allowing for manipulation by concurrent processes or threads. In this specific context, the openclaw application performs path-safety checks to ensure that file system mutations such as removal, directory creation, and renaming operations remain confined within a designated sandboxed mirror root. However, because these safety checks are not atomic with respect to the actual execution of the file system commands, an attacker who can influence or observe concurrent changes to the target path may exploit this window of opportunity.
The technical mechanism involves the remove, mkdir, and rename functions which validate that the intended operation targets a location within the allowed sandbox boundaries before proceeding. If the underlying filesystem structure is altered concurrently during the brief interval between the validation step and the execution step, the application may inadvertently operate on a different target than originally checked. This race condition allows an attacker to redirect these operations away from the intended mirror root. By carefully timing their actions or leveraging specific file system behaviors that allow rapid path manipulation, an adversary can cause the openclaw process to delete, create, or rename files and directories located outside the sandboxed environment.
The operational impact of this vulnerability is severe due to the privileges under which the openclaw process typically runs. Since the race condition enables actions on host paths with the permissions of the openclaw user account, an attacker can potentially modify critical system files, delete important data, or inject malicious content into locations outside the sandbox. This escalation occurs without requiring explicit operator consent for host filesystem access beyond the initial sandbox configuration. Consequently, even if strict sandboxing policies are in place to limit file system interactions, this flaw effectively bypasses those controls by exploiting the temporal gap in path validation logic.
From a classification perspective, this vulnerability aligns with CWE-367, which defines time-of-check time-of-use race conditions as flaws where software performs security checks on resources before using them but fails to maintain proper synchronization during that interval. Additionally, from an offensive security standpoint such as the MITRE ATT&CK framework, this behavior relates to techniques involving privilege escalation and defense evasion through resource manipulation. The ability to alter host file system structures outside of designated boundaries constitutes a significant breach of integrity controls typically enforced by sandboxing mechanisms.
To mitigate this vulnerability, organizations must immediately upgrade the openclaw package to version 2026.7.1 or later where these race conditions have been addressed through improved synchronization and atomic operations for path validation and execution. In environments where upgrading is not immediately feasible, implementing strict file system access controls using operating-level mechanisms such as mandatory access control systems can help limit the damage caused by unauthorized mutations. Additionally, monitoring for unusual patterns in file system activity within sandboxed directories may provide early detection of exploitation attempts while longer-term architectural reviews ensure that all path validation logic employs atomic operations to eliminate race windows entirely.