CVE-2026-27670: Openclaw Race Condition Vulnerability

CVE-2026-27670 Overview

OpenClaw versions prior to 2026.3.2 contain a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the ZIP extraction functionality. This vulnerability allows local attackers to write files outside the intended destination directory by exploiting a race between path validation and file write operations. Attackers can abuse parent directory symlink rebinding to redirect writes outside the extraction root, potentially leading to arbitrary file overwrites on the system.

Critical Impact

Local attackers can exploit this race condition to write arbitrary files outside the intended extraction directory, potentially overwriting critical system or application files.

Affected Products

• OpenClaw versions prior to 2026.3.2 (Node.js package)
• OpenClaw ZIP extraction functionality in src/infra/fs-safe.ts

Discovery Timeline

• 2026-03-19 - CVE-2026-27670 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-27670

Vulnerability Analysis

This vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition). The flaw exists in OpenClaw's ZIP extraction logic where there is an exploitable timing window between when a file path is validated and when the actual file write operation occurs.

The vulnerable code flow performs path validation to ensure extracted files remain within the designated extraction root directory. However, an attacker with local access can manipulate symbolic links in the parent directory chain during this brief window between validation and write. By rebinding symlinks at precisely the right moment, the attacker can redirect the file write operation to an arbitrary location outside the extraction root.

This race condition requires local access and precise timing, but successful exploitation allows modification of files outside the intended extraction boundary, potentially leading to privilege escalation or system compromise.

Root Cause

The root cause lies in the asynchronous file handling within src/infra/fs-safe.ts. The original implementation of openWritableFileWithinRoot validated the destination path but did not adequately protect against symlink manipulation between the time of path validation (check) and the actual file write operation (use). This TOCTOU vulnerability is particularly relevant on systems where attackers can rapidly modify filesystem symlinks.

Attack Vector

This is a local attack vector requiring the attacker to have execution privileges on the same system. The attack complexity is high due to the precise timing required to win the race condition. The attacker must:

1. Initiate or wait for a ZIP extraction operation targeting a directory they can access
2. Monitor the extraction process timing
3. Rapidly rebind parent directory symlinks between the path validation check and file write
4. Successfully redirect the write operation to an arbitrary location

The security patch addresses this by implementing a more robust approach to resolve the real path of opened file handles, using /proc/self/fd/ and /dev/fd/ on Linux systems to verify the actual destination after the file handle is opened:

export type SafeWritableOpenResult = {
  handle: FileHandle;
  createdForWrite: boolean;
  openedRealPath: string;
};

export async function resolveOpenedFileRealPathForHandle(
  handle: FileHandle,
  ioPath: string,
): Promise<string> {
  try {
    return await fs.realpath(ioPath);
  } catch (err) {
    if (!isNotFoundPathError(err)) {
      throw err;
    }
  }

  const fdCandidates =
    process.platform === "linux"
      ? [`/proc/self/fd/${handle.fd}`, `/dev/fd/${handle.fd}`]

Source: GitHub Commit Update

Detection Methods for CVE-2026-27670

Indicators of Compromise

• Unexpected files appearing outside designated extraction directories
• Anomalous symlink creation activity in directories where ZIP extraction occurs
• Modified system or application files with timestamps correlating to ZIP extraction operations
• Process monitoring showing rapid symlink manipulation concurrent with OpenClaw operations

Detection Strategies

• Monitor for rapid symlink creation/deletion patterns that could indicate race condition exploitation attempts
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications
• Audit OpenClaw extraction operations and compare extracted file paths against intended destinations
• Use process monitoring to detect suspicious concurrent filesystem operations during ZIP extraction

Monitoring Recommendations

• Enable enhanced filesystem auditing on extraction target directories
• Monitor for processes performing rapid symlink operations that could indicate TOCTOU exploitation
• Implement application-level logging to track all ZIP extraction operations with source and destination validation
• Review audit logs for file writes outside expected extraction boundaries

How to Mitigate CVE-2026-27670

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.2 or later immediately
• Audit systems for any unauthorized file modifications that may have resulted from exploitation
• Restrict local access to systems running vulnerable OpenClaw versions
• Consider implementing mandatory access control (MAC) policies to limit ZIP extraction destinations

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.2. The fix implements enhanced file handle validation using platform-specific mechanisms to resolve the actual file path after opening, preventing symlink race attacks. The patch is available in commit 7dac9b05dd9d38dd3929637f26fa356fd8bdd107.

For more details, refer to the GitHub Security Advisory and the GitHub Commit Update.

Workarounds

• Restrict local user access to systems running vulnerable OpenClaw versions
• Run OpenClaw extraction operations in isolated environments or containers with limited filesystem access
• Implement filesystem-level protections such as read-only mounts for sensitive directories
• Use mandatory access control (SELinux, AppArmor) to restrict OpenClaw's write destinations

# Example: Restrict extraction directories with read-only bind mounts for sensitive areas
# This limits the impact of successful exploitation
mount --bind /sensitive/path /sensitive/path
mount -o remount,ro /sensitive/path