CVE-2026-32977
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
OpenClaw before version 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile function. An attacker can exploit a TOCTOU race condition by modifying parent paths inside the sandbox, allowing files to be written outside the allowed area.
Risk Assessment
An attacker can write files to arbitrary locations on the filesystem, potentially leading to privilege escalation or execution of malicious code.
Recommendation
Update OpenClaw to version 2026.3.11 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox to redirect committed files outside the validated writable path within the container mount namespace.