CVE-2026-32977 in OpenClaw
Sumário (Inglês)
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox to redirect committed files outside the validated writable path within the container mount namespace.
Responsável
VulnCheck
Reservar
17/03/2026
Divulgação
31/03/2026
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354361 | OpenClaw Condição de Corrida | 367 | Não definido | Correção oficial | CVE-2026-32977 |