CVE-2026-33574: OpenClaw TOCTOU path traversal

CISO Take

OpenClaw's skills installer contains a TOCTOU race condition (CWE-367) where the tools-root path is validated lexically but can be rebound between validation and archive extraction, redirecting file writes to arbitrary system locations. This vulnerability sits within an ecosystem already actively abused — Bitdefender's February 2026 research (AIID #1368) found approximately 17% of OpenClaw ClawHub skills were malicious and delivering credential stealers, meaning the delivery mechanism for this attack is live, not theoretical. The local attack vector fires during normal skill installation with no privileges required beyond the installation action itself, and the TOCTOU pattern (CWE-367) is reliably exploitable on modern multi-core systems. Organizations running OpenClaw should upgrade immediately to 2026.3.8 (patch commit 9abf014f) and audit the skills directory for files written outside the intended tools root.

Sources: NVD EPSS GitHub Advisory (GHSA-vhwf-4x96-vqx2) ATLAS VulnCheck

What is the risk?

Medium overall (CVSS 6.2), elevated in AI agent deployment contexts. The score reflects local access scope and confidentiality impact only, but the AI-specific threat model amplifies risk significantly: in agent frameworks, 'local execution' is routinely triggered by installing third-party plugins without human review, and the TOCTOU pattern is reliably exploitable on multi-core hosts with low timing overhead. The ClawHub marketplace infection rate of ~17% malicious skills (per AIID #1368) represents a credible, active delivery mechanism that bridges network-accessible threat actors to this local vulnerability. The raw EPSS of 0.00087 is low, but that figure predates the confirmed skills ecosystem abuse context.

How does the attack unfold?

Malicious Skill Publication

Adversary publishes a crafted skill package to ClawHub containing a malicious archive with files designed to land outside the tools root on installation.

AML.T0104

Skill Installation Trigger

Target installs the malicious skill via OpenClaw's installer, which validates the tools-root path lexically and proceeds to download the archive, passing the path check.

AML.T0011

TOCTOU Path Rebinding

Between path validation and archive extraction, adversary or co-resident process rebinds the tools-root via symlink swap, redirecting all subsequent writes to an attacker-controlled filesystem location.

AML.T0010.005

Persistence and Credential Theft

Malicious files land in system directories (Python site-packages, shell profiles, cron), enabling persistent code execution or credential exfiltration matching the AMOS stealer pattern from AIID #1368.

AML.T0110

Malicious Skill Publication

Adversary publishes a crafted skill package to ClawHub containing a malicious archive with files designed to land outside the tools root on installation.

AML.T0104

Skill Installation Trigger

Target installs the malicious skill via OpenClaw's installer, which validates the tools-root path lexically and proceeds to download the archive, passing the path check.

AML.T0011

TOCTOU Path Rebinding

Between path validation and archive extraction, adversary or co-resident process rebinds the tools-root via symlink swap, redirecting all subsequent writes to an attacker-controlled filesystem location.

AML.T0010.005

Persistence and Credential Theft

Malicious files land in system directories (Python site-packages, shell profiles, cron), enabling persistent code execution or credential exfiltration matching the AMOS stealer pattern from AIID #1368.

AML.T0110

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.2 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 0% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: upgrade OpenClaw to 2026.3.8 (commit 9abf014f3502009faf9c73df5ca2cff719e54639 resolves the mutable path reuse).
Audit: enumerate files written outside the configured tools-root during or after skill installation; inspect ~/.bashrc, ~/.profile, cron directories, and Python site-packages for unexpected modifications.
Harden: run the skill installer under a dedicated low-privilege account in a sandbox or container with scoped write permissions restricted to the tools directory.
Detect: deploy file integrity monitoring (auditd, AIDE) on system directories before executing any OpenClaw skill installation workflow.
Restrict provenance: limit skill sources to signed or verified publishers until the ClawHub marketplace abuse documented in AIID #1368 is resolved upstream.

How is it classified?

Supply Chain Code Execution Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011 - User Execution AML.T0104 - Publish Poisoned AI Agent Tool AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10.5 - AI supply chain

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain and monitor AI risk management

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-33574?

OpenClaw's skills installer contains a TOCTOU race condition (CWE-367) where the tools-root path is validated lexically but can be rebound between validation and archive extraction, redirecting file writes to arbitrary system locations. This vulnerability sits within an ecosystem already actively abused — Bitdefender's February 2026 research (AIID #1368) found approximately 17% of OpenClaw ClawHub skills were malicious and delivering credential stealers, meaning the delivery mechanism for this attack is live, not theoretical. The local attack vector fires during normal skill installation with no privileges required beyond the installation action itself, and the TOCTOU pattern (CWE-367) is reliably exploitable on modern multi-core systems. Organizations running OpenClaw should upgrade immediately to 2026.3.8 (patch commit 9abf014f) and audit the skills directory for files written outside the intended tools root.

Is CVE-2026-33574 actively exploited?

No confirmed active exploitation of CVE-2026-33574 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33574?

1. Patch: upgrade OpenClaw to 2026.3.8 (commit 9abf014f3502009faf9c73df5ca2cff719e54639 resolves the mutable path reuse). 2. Audit: enumerate files written outside the configured tools-root during or after skill installation; inspect ~/.bashrc, ~/.profile, cron directories, and Python site-packages for unexpected modifications. 3. Harden: run the skill installer under a dedicated low-privilege account in a sandbox or container with scoped write permissions restricted to the tools directory. 4. Detect: deploy file integrity monitoring (auditd, AIDE) on system directories before executing any OpenClaw skill installation workflow. 5. Restrict provenance: limit skill sources to signed or verified publishers until the ClawHub marketplace abuse documented in AIID #1368 is resolved upstream.

What systems are affected by CVE-2026-33574?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool ecosystems, automated AI pipeline provisioning, local AI deployments.

What is the CVSS score for CVE-2026-33574?

CVE-2026-33574 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.09%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool ecosystemsautomated AI pipeline provisioninglocal AI deployments

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011 User Execution

AML.T0104 Publish Poisoned AI Agent Tool

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.5

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path between validation and final write to redirect the installer outside the intended tools directory.

Exploitation Scenario

An adversary publishes a crafted skill package to ClawHub containing a malicious archive with payloads designed to land outside the tools root. When a developer or automated pipeline installs the skill, OpenClaw's installer validates the tools-root path lexically and passes the check. The adversary's skill — or a co-resident malicious process — immediately rebinds a symlink or renames the tools directory between validation and archive extraction. The installer writes files from the archive to the rebound path outside the tools directory, dropping a .pth file into Python site-packages that exfiltrates environment variables and credentials on next interpreter startup. This mirrors the exact delivery pattern documented in AIID #1368, where malicious skills installed via ClawHub deployed the AMOS stealer and exfiltrated credentials.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.