CVE-2026-41296
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
68/100
Published: 2026-04-21
Modified: 2026-11-11
First seen: 2026-11-11
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
X
AT:
None
VC:
High
VI:
High
VA:
None
Description
OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to bypass sandbox restrictions and read arbitrary files.
Weakness Classification (1)
References & Advisories (3)
Vendor Advisory
Third Party Advisory
Patch