CVE-2026-100597: OpenClaw Race Condition Vulnerability

CVE-2026-100597 Overview

CVE-2026-100597 is a time-of-check time-of-use (TOCTOU) race condition in the OpenClaw npm package (openclaw) before version 2026.7.1. The flaw affects OpenShell local mirror filesystem mutation operations, specifically remove, mkdir, and rename. An attacker who wins the race between the sandbox path-safety check and the actual filesystem call can redirect the operation to a host path outside the intended mirror root. The resulting delete, create, or rename executes with the privileges of the OpenClaw process user. Exploitation does not require an operator to grant host filesystem access outside the sandbox. The issue is tracked under [CWE-367] and fixed in 2026.7.1.

Critical Impact
A local attacker who wins the race can delete, create, or rename arbitrary host files outside the OpenClaw sandbox mirror root, bypassing path-safety controls.

Affected Products

OpenClaw npm package (openclaw) versions prior to 2026.7.1
OpenShell local mirror filesystem component
Deployments exposing sandboxed remove, mkdir, or rename operations to lower-privileged callers

Discovery Timeline

2026-09-26 - CVE-2026-100597 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100597

Vulnerability Analysis

The vulnerability resides in OpenClaw's OpenShell local mirror, which exposes filesystem mutation primitives inside a sandboxed path hierarchy. Before performing remove, mkdir, or rename, OpenClaw validates that the target path resolves within the authorized mirror root. The validation and the subsequent syscall are not atomic. An attacker with local access can modify the path, typically by swapping a directory component for a symbolic link, between the check and the use. The syscall then operates on a target the sandbox never authorized. Because the operation runs with the OpenClaw process user's permissions, the attacker inherits that user's write authority across the host filesystem.

Root Cause

The root cause is non-atomic path validation [CWE-367]. OpenClaw canonicalizes and inspects the requested path, then issues the mutation using the same user-controlled path string rather than a stable file descriptor or an openat-style handle anchored to the mirror root. Concurrent filesystem changes invalidate the check before the syscall executes.

Attack Vector

Exploitation requires local access and the ability to invoke OpenClaw sandboxed filesystem operations. The attacker races OpenClaw by continuously rewriting a path component, for example toggling a symlink between a benign mirror target and a sensitive host path. When OpenShell dispatches remove, mkdir, or rename, the resolved target lies outside the mirror. Successful exploitation yields host-wide file deletion, directory creation, or renaming constrained only by the OpenClaw process user's permissions.

No verified exploit code is published. See the GitHub Security Advisory and the VulnCheck Advisory for OpenClaw for upstream technical details.

Detection Methods for CVE-2026-100597

Indicators of Compromise

Filesystem mutations by the OpenClaw process user targeting paths outside the configured mirror root
Symbolic links appearing or rapidly changing within OpenShell mirror directories during active sandbox operations
Unexpected unlink, mkdir, or rename syscalls on sensitive host paths originating from the OpenClaw process

Detection Strategies

Audit syscall telemetry for rename, unlinkat, and mkdirat calls issued by the OpenClaw process where the resolved path exits the mirror root
Monitor inotify or auditd events for high-frequency symlink creation and modification inside OpenShell-managed directories
Correlate OpenClaw application logs for path-safety check successes immediately followed by operations on unexpected inodes

Monitoring Recommendations

Enable Linux audit rules on paths managed by OpenClaw to capture path resolution anomalies
Alert on any filesystem write by the OpenClaw service account outside its declared mirror root
Track the installed openclaw package version across hosts and flag any version earlier than 2026.7.1

How to Mitigate CVE-2026-100597

Immediate Actions Required

Upgrade the openclaw npm package to version 2026.7.1 or later on all affected hosts
Inventory services that embed OpenClaw and restart them after the upgrade to load the patched code
Restrict local access to systems running OpenClaw to trusted operators until patching is complete

Patch Information

The maintainers fixed the TOCTOU race in OpenClaw 2026.7.1. Review the GitHub Security Advisory GHSA-crg9-c62w-j2p5 for release notes and upgrade guidance.

Workarounds

Run the OpenClaw process under a dedicated low-privilege user whose write permissions are limited to the mirror root
Place the OpenShell mirror root on a dedicated filesystem or bind mount with nosymfollow where supported
Disable or gate OpenShell remove, mkdir, and rename operations for untrusted callers until the patch is deployed

bash

# Upgrade OpenClaw to the patched release
npm install openclaw@2026.7.1
npm ls openclaw