8.3 HighCWE-367
CVE-2026-44113
OpenClaw vulnerability
Status
- Not in CISA KEV
- Fixed in version 2026.4.22
Exploit probabilityEPSSchecked 24 Oct
0.3%probability of exploitation in the next 30 days
Higher than 26% of scored CVEs
SeverityCVSS
8.3High
Description NVD
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 15 May · 16:10 UTC | The Hacker News | OpenClaw chain lets attackers hijack config and steal data |
| Mon 18 May · 12:41 UTC | SecurityWeek | ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery |
| Mon 18 May · 22:11 UTC | Dark Reading | OpenClaw bugs enable full system takeover via chained exploits |
- OpenClaw bugs enable full system takeover via chained exploitsDark Reading · mentions it in passing
- ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor DeliverySecurityWeek
- OpenClaw chain lets attackers hijack config and steal dataThe Hacker News · first in our coverage · mentions it in passing