CVE-2026-41296: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41296 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in OpenClaw's remote filesystem bridge readFile function that enables sandbox escape. Affecting all OpenClaw (npm) versions up to and including 2026.3.28, the flaw was disclosed on April 20–21, 2026, with a fix released in version 2026.3.31. It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-367 (Time-of-check Time-of-use Race Condition). In the vulnerable code path, the readFile function in remote-fs-bridge.ts performed path validation (via resolveCanonicalPath and assertNoHardlinkedFile) as a separate step from the actual file read operation (using cat -- "$1"), creating a race window between the two operations. An attacker with low-privileged network access could exploit this timing gap — for example, by swapping a validated path with a symlink or hardlink pointing to an arbitrary file outside the sandbox — to read files beyond the intended sandbox boundary. The fix (commit 121870a) replaces the two-step approach with an atomic read operation using a pinned parent directory file descriptor (open_dir + walk_dir + read_file via Python's os.open with dir_fd), and additionally rejects non-regular files and hardlinked files at read time (GitHub Commit, GitHub Advisory).

Successful exploitation allows a low-privileged network attacker to escape the OpenClaw sandbox and read arbitrary files on the host system, resulting in high confidentiality and integrity impact with a changed scope (resources beyond the vulnerable component are affected). Sensitive files such as credentials, configuration files, or private keys accessible to the OpenClaw process could be exfiltrated. Availability is not directly impacted, but the confidentiality and integrity exposure could facilitate further lateral movement or privilege escalation (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires low privileges and no user interaction, but exploitation is rated as high complexity due to the need to win a race condition. The EPSS score is approximately 0.026% (very low probability of exploitation in the near term). The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

1. Reconnaissance: Identify a target running OpenClaw (npm) version ≤ 2026.3.28 with the remote filesystem bridge enabled and accessible over the network with a low-privileged account.
2. Obtain low-privileged access: Authenticate to the OpenClaw service using any valid low-privileged credential or account.
3. Prepare the race payload: Create a benign file path within the sandbox workspace that will pass the initial path validation check (e.g., workspace/legit.txt).
4. Trigger the readFile operation: Initiate a readFile request targeting the benign path, causing the server to perform path validation.
5. Win the race window: Immediately after path validation completes but before the actual file read (cat -- "$1") executes, replace the validated path with a symlink or hardlink pointing to a sensitive file outside the sandbox (e.g., /etc/passwd, SSH private keys, or application secrets). This requires precise timing, typically achieved via a tight loop or concurrent threads.
6. Retrieve arbitrary file contents: The file read operation follows the now-replaced path, returning the contents of the target file outside the sandbox boundary to the attacker (GitHub Advisory, GitHub Commit).

• Network: Repeated or rapid readFile API requests from a single low-privileged account targeting the same or similar file paths in quick succession, potentially indicating race condition attempts.
• File System: Unexpected symlinks or hardlinks appearing transiently within the OpenClaw sandbox workspace directory, particularly pointing to files outside the workspace boundary (e.g., /etc/, ~/.ssh/).
• Logs: OpenClaw access logs showing high-frequency file read requests to the same path from a single session; error log entries related to path resolution or file type rejection (post-patch) that may indicate probing attempts.
• Process: Unusual child processes spawned by the OpenClaw Node.js process accessing files outside the designated workspace directory (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which contains the fix commit 121870a that atomically pins the parent directory file descriptor before reading, eliminating the TOCTOU window. Until patching is complete, consider restricting network-level access to the OpenClaw service to trusted users only, and audit file access logs for suspicious unauthorized read patterns. No official configuration-based workaround has been published as a substitute for upgrading (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher @AntAISecurityLab and credited in both the GitHub security advisory and the fix commit changelog. The advisory was published by maintainer steipete and the fix was authored by vincentkoc. No significant broader media coverage or notable social media discussion has been identified beyond standard CVE aggregator coverage (GitHub Advisory, GitHub Commit).