CVE-2026-41338: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41338 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in OpenClaw, an npm package, affecting all versions before 2026.3.31. The flaw exists in sandbox file operations — specifically in apply_patch, remove, and mkdir operations — where check-then-act patterns allow attackers to manipulate files between the validation and execution phases, bypassing fd-based sandbox defenses. It was published on April 23, 2026, with a patch released on April 28, 2026. The vulnerability carries a CVSS v4.0 base score of 4.3 (Medium) and a CVSS v3.1 base score of 5.0 (Medium) (Github Advisory, OpenClaw Advisory).

The vulnerability is classified as CWE-367 (Time-of-check Time-of-use Race Condition). In OpenClaw's sandbox workspace operations, path validation (checking that a file path is within the sandbox root) and the actual file system operation (remove, mkdir, write) are performed as separate, non-atomic steps. An attacker can exploit this window by rebinding a symbolic link — for example, swapping a directory alias from an inside-sandbox path to an outside-sandbox path — between the realpath/validation check and the actual fs.rm or fs.mkdir call, causing the operation to act on a target outside the sandbox boundary. The fix (commit 32a4a47) replaces the check-then-act pattern with fd-pinned operations using a Python helper that opens directory file descriptors at the root and walks path segments atomically, preventing symlink rebinding attacks (OpenClaw Advisory, Fix Commit).

Successful exploitation allows a low-privileged local attacker to bypass sandbox protections and perform unauthorized file modifications outside the intended workspace boundary, including deleting or creating files in arbitrary locations accessible to the process. The primary impact is high integrity loss — an attacker can alter or remove critical files outside the sandbox — with a low availability impact possible (e.g., deletion of important files). There is no confidentiality impact, as the vulnerability does not expose file contents. Lateral movement potential is limited given the local attack vector, but sandbox escape could enable privilege escalation or persistent modification of application files (Github Advisory, OpenClaw Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires local access, low privileges, user interaction, and high attack complexity (timing a race condition), which significantly limits its practical exploitability. The EPSS score is approximately 0.011–0.013%, placing it in the 2nd percentile for exploitation likelihood. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain local access: Obtain a low-privileged account on a system running a vulnerable version of OpenClaw (npm package version ≤ 2026.3.28).
2. Set up a rebindable symlink: Create a directory alias (symbolic link) inside the OpenClaw workspace that initially points to a legitimate inside-sandbox directory (e.g., slot -> /workspace/inside).
3. Trigger a sandbox file operation: Initiate an apply_patch, remove, or mkdir operation targeting a path that traverses the symlink (e.g., slot/target.txt). This causes OpenClaw to validate the path via realpath, confirming it resolves within the sandbox root.
4. Race the symlink rebind: Immediately after the path validation check completes but before the actual file system operation executes, atomically rebind the symlink to point to an outside-sandbox directory (e.g., slot -> /tmp/outside). This requires precise timing, potentially using OS scheduling techniques or repeated attempts.
5. Achieve out-of-sandbox file operation: The file system operation (e.g., fs.rm or fs.mkdir) now acts on the outside-sandbox target, deleting or creating files beyond the intended workspace boundary (OpenClaw Advisory, Fix Commit).

• File System: Unexpected file deletions or directory creations outside the OpenClaw workspace/sandbox root directory; presence of symbolic links inside the workspace pointing to external directories (e.g., /tmp, home directories, or system paths).
• Process: Unusual python3 child processes spawned by the OpenClaw Node.js process (post-patch behavior — absence of these in pre-patch versions may indicate unpatched deployment); rapid creation and modification of symlinks within the workspace directory.
• Logs: File system audit logs (e.g., auditd on Linux) showing unlink, rmdir, or mkdir syscalls resolving to paths outside the expected workspace root, initiated by the OpenClaw process; repeated realpath calls followed by file operations on different resolved paths.

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which contains the fix introduced in commit 32a4a47d602e0618f87b3e59f94d8c142767f860 (Fix Commit, OpenClaw Advisory). As a workaround prior to patching, restrict local system access to trusted users only and apply strict OS-level file access controls (e.g., using Linux namespaces or seccomp) to limit the OpenClaw process's ability to operate on paths outside the workspace. Monitor file system activity for unexpected operations outside the sandbox root. Ensure the OPENCLAW_PINNED_PYTHON environment variable is set to a trusted Python 3 binary to support the new fd-pinned path helper introduced in the fix.

The vulnerability was reported by security researcher AntAISecurityLab and acknowledged by the OpenClaw maintainer (steipete), who published the security advisory (GHSA-rm5c-4rmf-vvhw) with a narrow triage assessment, noting the original draft overstated scope and limiting the advisory to the actual sandbox-workspace mutation boundary (OpenClaw Advisory). No broader media coverage or significant community discussion has been identified beyond the GitHub advisory and standard vulnerability database entries.