CVE-2026-41383: OpenClaw Path Traversal Vulnerability

CVE-2026-41383 Overview

CVE-2026-41383 is an arbitrary directory deletion vulnerability (CWE-22: Path Traversal) in OpenClaw before version 2026.4.2. The vulnerability exists in the mirror mode functionality where attackers can delete remote directories by manipulating the remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. When exploited, attackers can cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data.

Critical Impact

Attackers with low privileges can manipulate OpenShell configuration paths to cause unauthorized deletion of remote directory contents through mirror sync operations, potentially leading to data loss and service disruption.

Affected Products

• OpenClaw versions prior to 2026.4.2
• OpenShell extension component
• Systems utilizing mirror mode synchronization

Discovery Timeline

• 2026-04-28 - CVE-2026-41383 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41383

Vulnerability Analysis

This vulnerability stems from insufficient validation of the mirror sync root directories in the OpenShell extension. The application fails to properly constrain the remoteWorkspaceDir and remoteAgentWorkspaceDir configuration parameters, allowing attackers to specify arbitrary directory paths outside the intended scope. When mirror sync operations execute, the application deletes the contents of the specified remote directories before uploading new workspace data, enabling attackers to target and destroy any accessible directories on the remote system.

The path traversal nature of this flaw (CWE-22) means that an authenticated attacker with low privileges can influence configuration values to point to sensitive system directories, resulting in unauthorized data destruction. The attack requires network access but can be executed without user interaction once the attacker has the necessary privileges to modify configuration values.

Root Cause

The root cause is the lack of validation and restriction on the remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values in the OpenShell extension. Prior to the patch, these values could be set to any arbitrary path without verification that they fall within the designated managed directories (/sandbox and /agent). This allowed attackers to scope mirror sync operations to directories outside the intended workspace boundaries.

Attack Vector

The attack is network-based and requires authenticated access with low privileges. An attacker manipulates the OpenShell configuration to set remoteWorkspaceDir or remoteAgentWorkspaceDir to a target directory path. When the mirror sync operation executes, it deletes the contents of the attacker-specified directory and replaces them with the workspace data. This can be leveraged to destroy critical system files, configuration data, or application resources on the remote system.

// Security patch constraining mirror sync roots
// Source: https://github.com/openclaw/openclaw/commit/b21c9840c2e38f4bb338d031511b479d5f07ca25

 const DEFAULT_REMOTE_WORKSPACE_DIR = "/sandbox";
 const DEFAULT_REMOTE_AGENT_WORKSPACE_DIR = "/agent";
 const DEFAULT_TIMEOUT_MS = 120_000;
+const OPEN_SHELL_MANAGED_REMOTE_ROOTS = [
+  DEFAULT_REMOTE_WORKSPACE_DIR,
+  DEFAULT_REMOTE_AGENT_WORKSPACE_DIR,
+] as const;
 
 function normalizeProviders(value: string[] | undefined): string[] {
   const seen = new Set<string>();

The patch introduces OPEN_SHELL_MANAGED_REMOTE_ROOTS to explicitly define the allowed root directories, ensuring mirror sync operations can only target the designated /sandbox and /agent paths.

Detection Methods for CVE-2026-41383

Indicators of Compromise

• Unexpected modifications to remoteWorkspaceDir or remoteAgentWorkspaceDir configuration values in OpenShell settings
• Mirror sync operations targeting directories outside /sandbox or /agent root paths
• Unusual deletion activity or data loss in remote directories not associated with normal workspace operations
• Configuration changes made by low-privileged users to mirror sync path settings

Detection Strategies

• Monitor OpenShell configuration files for unauthorized changes to workspace directory settings
• Implement file integrity monitoring on critical remote directories that should not be targets of sync operations
• Review audit logs for mirror sync operations that reference paths outside managed root directories
• Deploy endpoint detection rules to alert on path traversal patterns in configuration parameters

Monitoring Recommendations

• Enable detailed logging for all OpenShell mirror mode configuration changes
• Set up alerts for mirror sync operations that delete directories outside the /sandbox and /agent paths
• Implement real-time monitoring of file system changes on remote systems connected via OpenClaw
• Correlate configuration modification events with subsequent sync operation activity

How to Mitigate CVE-2026-41383

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.2 or later immediately
• Audit current remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values across all deployments
• Review access controls for users who can modify OpenShell configuration settings
• Implement backup procedures for critical remote directories that could be targeted

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.4.2. The fix introduces the OPEN_SHELL_MANAGED_REMOTE_ROOTS constant that constrains mirror sync operations to only the /sandbox and /agent directories. Organizations should apply the patch by updating to version 2026.4.2 or later. The security patch is available via commit b21c9840c2e38f4bb338d031511b479d5f07ca25.

For more details, refer to the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

• Restrict access to OpenShell configuration modification to only trusted administrators until the patch can be applied
• Implement network segmentation to limit exposure of systems running vulnerable OpenClaw versions
• Disable mirror mode functionality if not operationally required until patching is complete
• Apply file system permissions to protect critical directories from deletion by the OpenClaw process user

# Verify OpenClaw version and configuration
openclaw --version

# Review current workspace directory configurations
grep -r "remoteWorkspaceDir\|remoteAgentWorkspaceDir" /path/to/openclaw/config/

# Restrict configuration file permissions
chmod 600 /path/to/openclaw/config/openshell.config
chown root:root /path/to/openclaw/config/openshell.config