CVE-2026-32977 Overview
CVE-2026-32977 is a sandbox boundary bypass vulnerability in OpenClaw versions prior to 2026.3.11. The flaw exists in the fs-bridgewriteFile commit step, which uses an unanchored container path during the final move operation. An attacker with local, low-privileged access inside the sandbox can exploit a time-of-check-time-of-use (TOCTOU) race condition by modifying parent paths during the commit window. Successful exploitation redirects committed files outside the validated writable path within the container mount namespace. The weakness is tracked under CWE-367.
Critical Impact
Attackers can write attacker-controlled files outside the sandbox writable boundary, compromising integrity and availability of host-adjacent paths inside the container mount namespace.
Affected Products
- OpenClaw (Node.js distribution) versions prior to 2026.3.11
- Deployments using the fs-bridgewriteFile commit pipeline
- Container workloads relying on OpenClaw sandbox boundaries for filesystem isolation
Discovery Timeline
- 2026-03-31 - CVE-2026-32977 published to NVD
- 2026-04-02 - Last updated in NVD database
Technical Details for CVE-2026-32977
Vulnerability Analysis
The vulnerability resides in the fs-bridge subsystem of OpenClaw, which mediates filesystem writes between sandboxed code and the container's writable surface. The writeFile operation follows a two-phase commit pattern: a staged path is validated against the sandbox's allowed writable boundary, then a final move (rename) operation promotes the staged content to its destination. The destination path used during the commit step is not anchored to the previously validated root, leaving a window between validation and use.
Because the path is unanchored at commit time, an attacker who can manipulate intermediate directory entries can change what the final path resolves to. The commit then writes the file to a location that was never validated by the boundary check.
Root Cause
The root cause is a classic TOCTOU race condition [CWE-367]. The writeFile commit step re-resolves the destination path without re-anchoring it to the validated sandbox root or using a stable file descriptor obtained at validation time. Path resolution and filesystem move are not performed atomically against parent directory state.
Attack Vector
Exploitation requires local access with low privileges inside the sandboxed environment. The attacker initiates a writeFile operation targeting a legitimate path inside the sandbox writable area. During the narrow window between path validation and the commit move, the attacker modifies parent directory components, for example by replacing a parent directory with a symbolic link or renaming intermediate path segments. When the commit step resolves the unanchored path, it follows the attacker-controlled parent components and writes the file outside the validated boundary. The attack complexity is high because the race window is narrow and requires precise timing, but no user interaction is needed.
No verified public proof-of-concept code is available. Refer to the VulnCheck Advisory and the GitHub Security Advisory for additional technical context.
Detection Methods for CVE-2026-32977
Indicators of Compromise
- Files appearing on disk outside the configured OpenClaw sandbox writable root with timestamps correlating to fs-bridgewriteFile activity.
- Symbolic links or unexpected directory replacements within sandbox parent paths that occur shortly before a commit operation completes.
- OpenClaw audit log entries showing writeFile commits whose final resolved paths differ from the staged validation path.
Detection Strategies
- Enable verbose logging in the OpenClaw fs-bridge component and alert on path mismatches between the validation and commit phases of writeFile.
- Monitor filesystem audit events (Linux auditdrename and renameat2 syscalls) originating from OpenClaw worker processes that resolve outside the declared sandbox root.
- Correlate rapid sequences of rename, symlink, and unlink operations on parent directories of staged sandbox files, a behavioral signature of TOCTOU exploitation.
Monitoring Recommendations
- Baseline normal writeFile commit destinations per workload and alert on deviations outside the sandbox writable boundary.
- Track inode and dentry churn within sandbox parent directories to detect race-condition probing attempts.
- Ingest OpenClaw application logs and container runtime audit logs into a centralized analytics pipeline for cross-correlation of timing-sensitive events.
How to Mitigate CVE-2026-32977
Immediate Actions Required
- Upgrade OpenClaw to version 2026.3.11 or later across all affected deployments.
- Inventory all containers and workloads embedding OpenClaw as a dependency, including transitive Node.js dependencies, and prioritize patching.
- Restrict local access to sandboxed environments to trusted principals until the patch is deployed.
Patch Information
The vendor has released a fixed version. Review the GitHub Security Advisory GHSA-xvx8-77m6-gwg6 for patch details and upgrade guidance. The fix anchors the commit-time path resolution to the validated sandbox root, closing the TOCTOU window in the fs-bridgewriteFile commit step.
Workarounds
- Mount the sandbox writable area as a dedicated filesystem or bind mount with restrictive parent directory permissions to limit path manipulation primitives.
- Disable or gate the fs-bridgewriteFile commit feature for untrusted sandbox tenants until upgrading is feasible.
- Apply mandatory access control policies (SELinux or AppArmor) that constrain OpenClaw worker processes to the intended writable paths only.
# Configuration example: verify and upgrade OpenClaw to the fixed release
npm ls openclaw
npm install openclaw@2026.3.11
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
