CVE-2026-100597

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1

Description A time-of-check time-of-use (TOCTOU) race condition exists in OpenShell local mirror filesystem mutation operations. This occurs when the remove, mkdir, and rename operations act on a filesystem target that changes after the sandbox path-safety check is completed. An attacker who successfully exploits this race condition can delete, create, or rename host paths outside the intended mirror root using the permissions of the OpenClaw process user, bypassing the need for granted host filesystem access outside the sandbox.

Recommendations Update to version 2026.7.1.