CVE-2026-27670: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-27670 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in OpenClaw's ZIP extraction logic that allows local attackers to write files outside the intended destination directory. It affects all OpenClaw (npm) versions up to and including 2026.3.1; version 2026.3.2 contains the fix. The vulnerability was published on March 19, 2026, with the security advisory originally filed on March 3, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is a TOCTOU race condition (CWE-367) combined with improper link resolution (CWE-59) in src/infra/archive.ts. During ZIP extraction, the code previously validated output paths and then opened/truncated the destination file in a separate, non-atomic step. A local attacker can exploit the timing window between path validation and the actual file write by rebinding a parent directory symlink — replacing a legitimate directory with a symlink pointing to an arbitrary location outside the extraction root — causing the write to land outside the intended destination. The fix, introduced in commit 7dac9b05, hardens the process by binding writes to the opened file handle identity, using O_EXCL/O_NOFOLLOW flags, performing realpath verification via src/infra/fs-safe.ts, and deferring truncation until after all identity and boundary checks are complete (GitHub Advisory, Fix Commit).

Successful exploitation allows a local attacker with low privileges to redirect ZIP extraction writes to arbitrary filesystem locations outside the intended extraction root. Depending on which files are overwritten, this could result in corruption or replacement of critical system or application files, potentially leading to privilege escalation, denial of service, or arbitrary code execution. Confidentiality impact is assessed as none, while integrity impact is high and availability impact is low (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires local access and low privileges, and exploitation is rated high complexity due to the need to win a race condition. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable version of OpenClaw (≤ 2026.3.1).
2. Identify extraction target: Determine a directory where OpenClaw performs ZIP extraction and identify a subdirectory (e.g., slot/) that will be used as a parent directory during extraction.
3. Prepare the symlink race: Before or during extraction, set up the slot/ directory as a legitimate directory initially pointing inside the extraction root.
4. Craft a malicious ZIP: Create a ZIP archive containing an entry such as slot/target.txt with attacker-controlled content intended to overwrite a sensitive file outside the extraction root.
5. Trigger extraction and race the symlink: Initiate ZIP extraction. In a concurrent process, monitor for the moment after path validation completes but before the file write occurs, then atomically replace the slot/ directory with a symlink pointing to a target directory outside the extraction root (e.g., a system configuration directory).
6. Achieve arbitrary file write: If the race is won, the file write lands in the symlink-redirected location, overwriting the target file outside the extraction root with attacker-controlled content, potentially enabling privilege escalation or code execution (GitHub Advisory, Fix Commit).

• File System: Unexpected files appearing outside the designated ZIP extraction directory, particularly in system or application directories; symlinks in extraction subdirectories pointing to locations outside the extraction root; newly created or modified files in sensitive directories coinciding with ZIP extraction operations.
• Process: Concurrent processes rapidly creating and removing symlinks within ZIP extraction directories during an extraction operation; unusual file write activity from the OpenClaw Node.js process to directories outside expected extraction paths.
• Logs: File system audit logs (e.g., auditd on Linux) showing symlink, unlink, and open syscalls on extraction subdirectories in rapid succession; Node.js process logs indicating destination-symlink-traversal errors if a patched version detects the attack (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.3.2 or later, which contains the security fix introduced in commit 7dac9b05dd9d38dd3929637f26fa356fd8bdd107. Until patching is feasible, restrict local user access to systems running vulnerable OpenClaw versions and monitor ZIP extraction directories for suspicious symlink activity. Implementing file system integrity monitoring (e.g., with auditd or similar tools) to detect unauthorized writes outside expected extraction directories is recommended as an interim measure (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher tdjackey and the advisory was published by steipete on the OpenClaw GitHub repository. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).