VULNERABILITY INTELLIGENCE

CVE-2026-41296

CVSS score8.2 HIGH
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-04-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Description

OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to bypass sandbox restrictions and read arbitrary files.

Weakness classification

  • disclosure@vulncheck.com: CWE-367

Primary references