CVE-2026-44113

Katalog CVE

CVSS 7.7 · High EPSS 0,34%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada openclaw. Skor CVSS 3.1 7.7 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.7 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3g-6xhh-rg6p mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/95119017c847c737bd113f0bff728c4666d79c45 patch
• https://www.vulncheck.com/advisories/openclaw-time-of-check-time-of-use-race-condition-in-openshell-fs-bridge advisory pihak ketiga