CVE-2026-44112: OpenClaw: TOCTOU symlink race escapes OpenShell sandbox

CRITICAL

Published May 6, 2026

CISO Take

OpenClaw before 2026.4.22 has a time-of-check/time-of-use race (CWE-367) in OpenShell sandbox filesystem writes. An attacker can swap a symlink mid-operation and redirect writes outside the intended mount root, which defeats the sandbox boundary for an AI agent runtime. The CVSS of 9.6 reflects a scope change with high integrity and availability impact, but real-world urgency is moderate: EPSS is 0.00389 (top 69%), it is not in CISA KEV, CISA SSVC says TRACK, and there is no public exploit or Nuclei template. Blast radius through packages is small (3 downstream dependents), yet OpenClaw has a documented history of abuse in the wild, such as malicious skills (AIID #1368) and use in a reported multi-agent intrusion (AIID #1646), so agent hosts holding credentials deserve priority. Upgrade to OpenClaw 2026.4.22 or later (vendor patch commit 7be82d4), and until then restrict untrusted skills and prompts that can trigger sandbox file writes.

Sources:NVDEPSSGitHub AdvisoryVulnCheckATLASAI Incident Database

What is the risk?

Rated critical by CVSS (9.6, network, low complexity, low privileges, no user interaction, scope changed), but practical exploitation risk is moderate. A TOCTOU race needs timing and some ability to create or swap symlinks in the sandbox-visible filesystem, which usually means the attacker already controls agent actions, a skill, or prompt-driven tool calls. EPSS is low (0.00389, top 69%), there is no KEV listing, no public exploit and no scanner template, and SSVC says TRACK. Impact is high where the host runs agents with broad privileges, because writes outside the mount root can modify host configuration, startup scripts, or agent configuration. Package-level exposure is limited (3 dependents). Confidence: MEDIUM, since patched version ranges are not given in structured form and the advisory details come from vendor and VulnCheck sources.

How does the attack unfold?

Initial Access

Attacker gains the ability to influence agent filesystem writes through a malicious skill, prompt injection, or a low-privileged account on an OpenClaw host.

AML.T0053

Exploitation

Attacker repeatedly swaps a path in the mount root between a regular directory and a symlink, winning the race between the sandbox check and the write.

AML.T0105

Persistence

The redirected write lands outside the mount root and overwrites a startup script, cron entry, or agent configuration so that attacker content runs later.

AML.T0081

Impact

Host files are tampered with or corrupted, causing integrity loss and service disruption beyond the sandbox, with possible follow-on access to agent-held credentials.

AML.T0112.000

Initial Access

Attacker gains the ability to influence agent filesystem writes through a malicious skill, prompt injection, or a low-privileged account on an OpenClaw host.

AML.T0053

Exploitation

Attacker repeatedly swaps a path in the mount root between a regular directory and a symlink, winning the race between the sandbox check and the write.

AML.T0105

Persistence

The redirected write lands outside the mount root and overwrites a startup script, cron entry, or agent configuration so that attacker content runs later.

AML.T0081

Impact

Host files are tampered with or corrupted, causing integrity loss and service disruption beyond the sandbox, with possible follow-on access to agent-held credentials.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~7d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

7.3%

chance of exploitation in 30 days

Higher than 94% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CNone

IHigh

AHigh

What should I do?

1 step

1) Upgrade OpenClaw to 2026.4.22 or later, which contains the fix (commit 7be82d4fd1193bcb7e44ee38838f00bf924ffa76); see advisory GHSA-wppj-c6mr-83jj. 2) Until patched, avoid running untrusted or unvetted skills, and limit which users or prompts can trigger sandbox filesystem writes. 3) Run OpenClaw as an unprivileged user inside a container or VM with a read-only root filesystem and only the required writable mounts, so a sandbox escape is bounded by an outer boundary. 4) Deny agents the ability to create symlinks in the mount root where feasible, and use nosymlink or nodev mount options where supported. 5) Detection: monitor for file writes by the OpenClaw process outside its mount root, rapid symlink create/replace/delete patterns in the sandbox directory, and unexpected changes to shell profiles, cron, systemd units, and agent configuration. 6) Inventory OpenClaw installs, including developer machines, and confirm versions.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainAgentFrameworkPluginAML.T0053- AI Agent Tool Invocation AML.T0097- Virtualization/Sandbox Evasion AML.T0105- Escape to Host AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM06:2025-Excessive Agency

Frequently Asked Questions

What is CVE-2026-44112?

Is CVE-2026-44112 actively exploited?

No confirmed active exploitation of CVE-2026-44112 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-44112?

1) Upgrade OpenClaw to 2026.4.22 or later, which contains the fix (commit 7be82d4fd1193bcb7e44ee38838f00bf924ffa76); see advisory GHSA-wppj-c6mr-83jj. 2) Until patched, avoid running untrusted or unvetted skills, and limit which users or prompts can trigger sandbox filesystem writes. 3) Run OpenClaw as an unprivileged user inside a container or VM with a read-only root filesystem and only the required writable mounts, so a sandbox escape is bounded by an outer boundary. 4) Deny agents the ability to create symlinks in the mount root where feasible, and use nosymlink or nodev mount options where supported. 5) Detection: monitor for file writes by the OpenClaw process outside its mount root, rapid symlink create/replace/delete patterns in the sandbox directory, and unexpected changes to shell profiles, cron, systemd units, and agent configuration. 6) Inventory OpenClaw installs, including developer machines, and confirm versions.

What systems are affected by CVE-2026-44112?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Sandboxed code execution environments, Developer workstation AI agents, Agent skill/plugin ecosystems.

What is the CVSS score for CVE-2026-44112?

CVE-2026-44112 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 7.31%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksSandboxed code execution environmentsDeveloper workstation AI agentsAgent skill/plugin ecosystems

MITRE ATLAS Techniques

AML.T0053AI Agent Tool Invocation

AML.T0097Virtualization/Sandbox Evasion

AML.T0105Escape to Host

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.

Exploitation Scenario

An attacker publishes a plausible third-party OpenClaw skill, or gets a prompt injected into an agent, that causes the agent to perform repeated sandbox writes. In parallel, a helper process rapidly swaps a directory inside the mount root between a regular path and a symlink pointing at a sensitive host location. By winning the race between the sandbox path check and the actual write, the write lands outside the mount root, for example in a shell startup file, a cron entry, or the agent's own configuration. On the next login or scheduled run, the planted content executes with the agent user's privileges, giving persistence and further access to credentials the agent holds.

Weaknesses (CWE)

CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.