Executive Summary

CVE-2026-32988 is a sandbox boundary bypass vulnerability in OpenClaw versions before 2026.3.11. It occurs in the fs-bridge staged writes component where temporary files are created and populated without being securely confined to a verified parent directory.

This flaw introduces a race condition (Time-of-check to Time-of-use, TOCTOU) where an attacker can exploit changes in parent-path aliases to cause temporary files to be created outside the intended validated directory before the final guarded atomic replace operation executes.

Technically, the vulnerability arises because the staging process uses shell path operations to create and write temporary files in the target directory before the final rename step revalidates the destination. The final guard only protects the rename operation, not the earlier temporary file creation, allowing potential escape from the sandboxed directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to bypass sandbox restrictions and write arbitrary data outside the intended validated directory.

Such unauthorized writes can compromise system integrity and availability within the writable mount scope.

Because the attacker can place attacker-controlled bytes outside the sandbox, this could lead to potential system compromise or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should upgrade OpenClaw to version 2026.3.11 or later.

The fix ensures that temporary files are created strictly inside a verified parent directory, eliminating the race condition that allows sandbox boundary bypass.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0