CVE-2026-44112

Katalog CVE

CVSS 9.6 · Critical EPSS 0,39%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada openclaw. Skor CVSS 3.1 9.6 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-wppj-c6mr-83jj mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/7be82d4fd1193bcb7e44ee38838f00bf924ffa76 patch
• https://www.vulncheck.com/advisories/openclaw-symlink-swap-race-condition-in-openshell-fs-bridge-writes advisory pihak ketiga