CVE-2026-33574: Openclaw Path Traversal Vulnerability

CVE-2026-33574 Overview

CVE-2026-33574 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability affecting OpenClaw before version 2026.3.8. The vulnerability exists in the skills download installer component, which validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can exploit this race condition by rebinding the tools-root path between validation and final write operations, redirecting the installer outside the intended tools directory.

Critical Impact

Local attackers can exploit this path traversal vulnerability to write arbitrary files outside the intended tools directory, potentially leading to code execution or system compromise through file overwrite attacks.

Affected Products

• OpenClaw versions prior to 2026.3.8
• OpenClaw for Node.js (all platforms)

Discovery Timeline

• 2026-03-29 - CVE-2026-33574 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33574

Vulnerability Analysis

This vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition). The skills download installer in OpenClaw performs path validation to ensure files are written within the designated tools directory. However, the implementation contains a fundamental flaw: after validating the tools-root path lexically, the installer reuses this mutable path object during subsequent archive download and copy operations without re-verification.

The window between the initial path validation and the final file write operation creates an exploitable race condition. During this window, a local attacker with appropriate privileges can rebind the tools-root path to point to an arbitrary location on the filesystem. When the installer proceeds to write files using the rebinded path, the files are written outside the intended tools directory.

Root Cause

The root cause is improper handling of mutable path references in the skills download installer. The code validates the destination path at check-time but does not lock or re-validate the path at use-time. This classic TOCTOU vulnerability pattern allows path rebinding between validation and file operations, circumventing the intended security boundary that should confine writes to the tools directory.

Attack Vector

The attack requires local access to the system where OpenClaw is running. An attacker must be able to monitor and predict when the skills download installer is executing its validation phase, then quickly rebind the tools-root path (via symlink manipulation, mount point changes, or other filesystem-level techniques) before the write operation completes. While the local access requirement and timing constraints provide some protection, successful exploitation enables arbitrary file writes which can lead to privilege escalation or code execution.

The vulnerability manifests during the archive extraction phase of the skills download process. The installer first checks that the target path is within the tools directory boundary, but the path object remains mutable. An attacker can replace the validated directory with a symlink pointing elsewhere before the actual file write occurs. For detailed technical analysis, refer to the VulnCheck Advisory.

Detection Methods for CVE-2026-33574

Indicators of Compromise

• Unexpected symlinks created within the OpenClaw tools directory pointing to system-critical paths
• Suspicious file creation or modification events in directories outside the expected tools root
• Evidence of rapid filesystem operations (symlink creation/deletion) timed with OpenClaw skills download activity
• Unexpected files appearing in system directories that correlate with OpenClaw installation activity

Detection Strategies

• Monitor for symlink creation and modification events in the OpenClaw tools directory using file integrity monitoring tools
• Implement real-time filesystem auditing to detect path rebinding attempts during OpenClaw operations
• Deploy endpoint detection rules that alert on skills download operations followed by writes outside the tools directory
• Review OpenClaw process activity for anomalous file system calls that suggest race condition exploitation

Monitoring Recommendations

• Enable detailed audit logging for all OpenClaw installation and update operations
• Configure SentinelOne or equivalent EDR solutions to monitor Node.js process file operations with path traversal detection
• Establish baseline behavior for OpenClaw skills downloads and alert on deviations
• Monitor for privilege escalation attempts that may follow successful exploitation

How to Mitigate CVE-2026-33574

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.8 or later immediately
• Review recent OpenClaw skills download activity for signs of exploitation
• Audit file integrity across the system to identify any unauthorized file modifications
• Restrict local access to systems running vulnerable OpenClaw versions until patching is complete

Patch Information

The OpenClaw maintainers have addressed this vulnerability in version 2026.3.8. The fix is available in commit 9abf014. Additional details can be found in the GitHub Security Advisory GHSA-vhwf-4x96-vqx2. Organizations should apply this update through their standard Node.js package management workflow.

Workarounds

• Disable skills download functionality if not required until the patch can be applied
• Run OpenClaw with minimal filesystem permissions to limit the impact of potential exploitation
• Implement additional access controls on the tools directory to prevent symlink creation by non-privileged users
• Consider containerizing OpenClaw installations to limit filesystem access scope

# Upgrade OpenClaw to the patched version
npm update openclaw@2026.3.8

# Verify installed version
npm list openclaw