Vulnerability intelligence
CVE-2026-44113
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.
CVSS Score
8.3
High
EPSS — Exploit Probability
0.2%
Riskier than 11% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
3 articles across 3 outlets · first covered May 15, 2026 · latest May 18, 2026
Coverage timeline
-
OpenClaw bugs enable full system takeover via chained exploitswww.darkreading.com · May 18, 2026
-
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Deliverywww.securityweek.com · May 18, 2026
-
OpenClaw chain lets attackers hijack config and steal datathehackernews.com · May 15, 2026