CVE-2026-43529 Details
Description
OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the target file between validation and preflight read, causing the validator to inspect a different file identity than the one that passed the initial boundary check.
A time-of-check-time-of-use (TOCTOU) vulnerability has been identified in OpenClaw versions prior to 2026.4.10. The issue resides in the 'validateScriptFileForShellBleed' function, where local attackers can bypass workspace boundary checks. An attacker with write access to the workspace can exploit this vulnerability by swapping the target file between the validation and preflight read stages. This race condition causes the validator to read a different file identity than the one that initially passed the boundary check.
Users are advised to upgrade to OpenClaw version 2026.4.10 or later, as the latest npm release includes the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.4.10 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 5, 2026 | New CVE Received | [email protected] |