CVE-2026-41364: Openclaw Path Traversal Vulnerability

CVE-2026-41364 Overview

CVE-2026-41364 is a symlink following vulnerability (CWE-59) in OpenClaw before version 2026.3.31 that affects the SSH sandbox tar upload functionality. This vulnerability allows remote attackers to write arbitrary files by uploading malicious tar archives containing symlinks, effectively escaping the intended sandbox restrictions and overwriting files on the remote host.

Critical Impact
Remote attackers with authenticated access can escape the SSH sandbox and write arbitrary files to the host filesystem, potentially leading to remote code execution, configuration tampering, or complete system compromise.

Affected Products

OpenClaw versions prior to 2026.3.31
OpenClaw for Node.js (all vulnerable versions)
Systems utilizing OpenClaw SSH sandbox tar upload functionality

Discovery Timeline

2026-04-28 - CVE-2026-41364 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41364

Vulnerability Analysis

This symlink following vulnerability exists in OpenClaw's SSH sandbox tar upload feature. The vulnerability stems from insufficient validation of symbolic links within uploaded tar archives. When an attacker uploads a tar archive to the SSH sandbox, the application extracts the contents without properly verifying whether symlinks point to locations outside the designated sandbox directory.

The attack exploits a fundamental weakness in how the application handles path resolution for symlinks during tar extraction. By crafting a tar archive with symlinks that traverse outside the sandbox boundary, an attacker can redirect file writes to arbitrary locations on the filesystem.

Root Cause

The root cause is the lack of boundary path validation when processing symbolic links within uploaded tar archives. The vulnerable implementation failed to resolve and validate symlink targets against the sandbox boundary before allowing file operations. This allows symlinks pointing to parent directories (using ../ sequences) or absolute paths to escape the intended containment.

Attack Vector

The attack is network-based and requires low-privilege authentication. An attacker would:

Craft a malicious tar archive containing symlinks pointing outside the sandbox directory
Upload the tar archive via the SSH sandbox upload functionality
The application extracts the archive, following symlinks without boundary validation
Files are written to arbitrary locations on the host filesystem based on symlink targets

typescript

// Security patch in src/agents/sandbox/ssh.ts
// Source: https://github.com/openclaw/openclaw/commit/3d5af14984ac1976c747a8e11581d697bd0829dc

 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { resolveBoundaryPath } from "../../infra/boundary-path.js";
 import { parseSshTarget } from "../../infra/ssh-tunnel.js";
 import { resolvePreferredOpenClawTmpDir } from "../../infra/tmp-openclaw-dir.js";
 import { resolveUserPath } from "../../utils.js";

The patch introduces resolveBoundaryPath to validate that all symlink targets remain within the sandbox boundary before file operations proceed.

Detection Methods for CVE-2026-41364

Indicators of Compromise

Unexpected file modifications outside OpenClaw sandbox directories
SSH sandbox upload logs showing tar archives with suspicious symlink patterns
New or modified system configuration files that correlate with SSH sandbox activity
Evidence of path traversal sequences (../) in uploaded archive contents

Detection Strategies

Monitor filesystem integrity in directories adjacent to or parent to OpenClaw sandbox locations
Implement file integrity monitoring (FIM) on critical system files and configurations
Log and analyze tar archive contents during upload, specifically looking for symlinks with path traversal patterns
Review OpenClaw access logs for unusual upload patterns or large tar archives

Monitoring Recommendations

Enable verbose logging for OpenClaw SSH sandbox operations
Deploy SentinelOne Singularity Platform to detect and alert on unexpected file write operations outside application boundaries
Implement network monitoring for anomalous SSH sandbox traffic patterns
Set up alerts for file modifications in system-critical directories that correlate with OpenClaw process activity

How to Mitigate CVE-2026-41364

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.31 or later immediately
Audit recent SSH sandbox uploads for malicious tar archives containing symlinks
Review filesystem for unexpected file modifications, especially in sensitive directories
Restrict SSH sandbox access to trusted users only until patching is complete

Patch Information

OpenClaw has released a security patch that introduces boundary path validation for symlink resolution. The fix is available in commit 3d5af14984ac1976c747a8e11581d697bd0829dc. Organizations should update to OpenClaw version 2026.3.31 or later, which includes the resolveBoundaryPath function to properly validate symlink targets before file operations.

For detailed vulnerability information, see the GitHub Security Advisory and the VulnCheck Advisory Report.

Workarounds

Disable SSH sandbox tar upload functionality until patching is possible
Implement network-level controls to restrict access to OpenClaw SSH services
Use additional sandboxing mechanisms (containers, chroot) to limit potential impact of sandbox escapes
Configure filesystem permissions to minimize writable areas accessible from the OpenClaw process context

bash

# Temporary mitigation: Restrict SSH sandbox access
# Add to OpenClaw configuration or system firewall rules
# Limit access to SSH sandbox to trusted IP ranges only
iptables -A INPUT -p tcp --dport 22 -s TRUSTED_IP_RANGE -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP