CVE-2026-27670: OpenClaw TOCTOU race enables

CISO Take

CVE-2026-27670 is a time-of-check-time-of-use race condition in OpenClaw's ZIP extraction that lets a local attacker with low privileges redirect file writes outside the extraction root by swapping a parent directory symlink between path validation and the actual write operation. In AI agent deployments where OpenClaw routinely ingests third-party skill packages and plugins as ZIP archives — often under broad filesystem trust — this vulnerability can be weaponized to overwrite agent configuration, poison tool definitions, or inject malicious Python modules that execute on the next agent invocation, with 4 downstream dependents extending the blast radius modestly. EPSS probability is very low (0.00081) with no active exploitation in CISA KEV and no public exploit or scanner template available, placing current risk as theoretical but structurally significant given OpenClaw's third-party skill ecosystem as documented in AIID #1368. Patch to version 2026.3.2 immediately; until then, run ZIP extraction in a containerized sandbox with read-only bind mounts on all directories outside the designated extraction root.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Risk is medium-low in isolation but contextually elevated for organizations running OpenClaw agents with broad filesystem access. The CVSS 5.3 medium score reflects real constraints: local access is required, attack complexity is high due to precise race timing demands, and there is no public exploit or active exploitation on record. However, the AI agent context worsens the picture — agents that automatically process external skill packages amplify the impact from a local integrity issue to a potential persistent agent compromise. No KEV listing and very low EPSS (0.00081) confirm no current active threat, but the structural vulnerability in an automated skill ingestion path warrants prompt patching rather than deferred treatment.

How does the attack unfold?

Initial Access

Attacker with low local privileges, or via a malicious skill package planted in a third-party registry like ClawHub, crafts a ZIP archive with paths that initially pass OpenClaw's validation checks.

AML.T0010.005

Race Exploitation

During extraction, the attacker exploits the TOCTOU window by replacing the parent directory component of the validated path with a symlink pointing to a sensitive directory outside the extraction root before the file write executes.

Persistence

Malicious files — tool scripts, configuration overrides, or Python modules — are written to the symlink target and survive agent restarts, establishing persistent unauthorized control over agent behavior.

AML.T0081

Agent Compromise

On the next OpenClaw agent invocation, injected code executes within the agent's security context, enabling credential theft, lateral movement, or full local agent compromise.

AML.T0112.000

Initial Access

Attacker with low local privileges, or via a malicious skill package planted in a third-party registry like ClawHub, crafts a ZIP archive with paths that initially pass OpenClaw's validation checks.

AML.T0010.005

Race Exploitation

During extraction, the attacker exploits the TOCTOU window by replacing the parent directory component of the validated path with a symlink pointing to a sensitive directory outside the extraction root before the file write executes.

Persistence

Malicious files — tool scripts, configuration overrides, or Python modules — are written to the symlink target and survive agent restarts, establishing persistent unauthorized control over agent behavior.

AML.T0081

Agent Compromise

On the next OpenClaw agent invocation, injected code executes within the agent's security context, enabling credential theft, lateral movement, or full local agent compromise.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 0% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.3.2 or later (see commit 7dac9b05dd9d38dd3929637f26fa356fd8bdd107).
Workaround: Run ZIP extraction inside containers with read-only bind mounts on all directories outside the designated extraction root.
Workaround: Enable OS-level symlink restriction on the extraction host (Linux: set fs.protected_symlinks=1 via sysctl; mount extraction volumes with MS_NOSYMFOLLOW where supported).
Detection: Deploy auditd or eBPF-based file monitoring to alert on write syscalls producing paths outside the expected extraction directory during OpenClaw runtime.
Supply chain: Enforce cryptographic integrity checks (SHA-256) on all ZIP archives prior to extraction and restrict package sources to verified, allowlisted registries.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Agent Framework AML.T0010.005 - AI Agent Tool AML.T0081 - Modify AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system security

NIST AI RMF

MANAGE 2.2 - Risk Treatment

OWASP LLM Top 10

LLM03 - Supply Chain

Frequently Asked Questions

What is CVE-2026-27670?

CVE-2026-27670 is a time-of-check-time-of-use race condition in OpenClaw's ZIP extraction that lets a local attacker with low privileges redirect file writes outside the extraction root by swapping a parent directory symlink between path validation and the actual write operation. In AI agent deployments where OpenClaw routinely ingests third-party skill packages and plugins as ZIP archives — often under broad filesystem trust — this vulnerability can be weaponized to overwrite agent configuration, poison tool definitions, or inject malicious Python modules that execute on the next agent invocation, with 4 downstream dependents extending the blast radius modestly. EPSS probability is very low (0.00081) with no active exploitation in CISA KEV and no public exploit or scanner template available, placing current risk as theoretical but structurally significant given OpenClaw's third-party skill ecosystem as documented in AIID #1368. Patch to version 2026.3.2 immediately; until then, run ZIP extraction in a containerized sandbox with read-only bind mounts on all directories outside the designated extraction root.

Is CVE-2026-27670 actively exploited?

No confirmed active exploitation of CVE-2026-27670 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27670?

1. Patch: Upgrade OpenClaw to 2026.3.2 or later (see commit 7dac9b05dd9d38dd3929637f26fa356fd8bdd107). 2. Workaround: Run ZIP extraction inside containers with read-only bind mounts on all directories outside the designated extraction root. 3. Workaround: Enable OS-level symlink restriction on the extraction host (Linux: set fs.protected_symlinks=1 via sysctl; mount extraction volumes with MS_NOSYMFOLLOW where supported). 4. Detection: Deploy auditd or eBPF-based file monitoring to alert on write syscalls producing paths outside the expected extraction directory during OpenClaw runtime. 5. Supply chain: Enforce cryptographic integrity checks (SHA-256) on all ZIP archives prior to extraction and restrict package sources to verified, allowlisted registries.

What systems are affected by CVE-2026-27670?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Local AI agent deployments, AI development workspaces, Plugin and skill ingestion pipelines.

What is the CVSS score for CVE-2026-27670?

CVE-2026-27670 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.08%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLocal AI agent deploymentsAI development workspacesPlugin and skill ingestion pipelines

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0081 Modify AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.

Exploitation Scenario

A threat actor with local access — via a compromised CI runner, malicious insider, or rogue skill package planted in ClawHub — crafts a ZIP archive whose extracted paths initially validate as safe within the extraction root. When an OpenClaw agent begins installing the skill, the attacker races the TOCTOU window to replace the parent directory component of the validated path with a symlink pointing to a high-value target such as ~/.config/openclaw/tools/ or /usr/local/lib/python3.x/dist-packages/openclaw/. The file write completes at the symlink destination, planting a malicious tool definition or Python module. On the agent's next scheduled invocation, the injected code executes within OpenClaw's security context, enabling credential harvesting, lateral movement, or persistent backdoor access — directly mirroring the attack class documented in AIID #1368.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.