CVE-2026-41397— OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal
Quick assessment
Affected
OpenClaw OpenClaw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.3.31之前版本存在后置链接漏洞，该漏洞源于沙箱逃逸问题，可能导致远程攻击者通过文件同步操作中的符号链接利用绕过沙箱限制访问任意文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41397
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions by crafting malicious symlinks in mirror sync operations to access arbitrary files outside intended boundaries.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Vulnerability Title
OpenClaw 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.3.31之前版本存在后置链接漏洞，该漏洞源于沙箱逃逸问题，可能导致远程攻击者通过文件同步操作中的符号链接利用绕过沙箱限制访问任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-41397
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41397
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-41397 (2)
Vendor Advisories for CVE-2026-41397 (2)
Same Patch Batch · OpenClaw · 2026-04-28 · 53 CVEs total
| CVE-2026-41386 | 9.1 CRITICAL | OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes |
| CVE-2026-42426 | 8.8 HIGH | OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope |
| CVE-2026-42422 | 8.8 HIGH | OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function |
| CVE-2026-41378 | 8.8 HIGH | OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node |
| CVE-2026-41404 | 8.8 HIGH | OpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authenticatio |
| CVE-2026-41914 | 8.5 HIGH | OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths |
| CVE-2026-41394 | 8.2 HIGH | OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth R |
| CVE-2026-42431 | 8.1 HIGH | OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass |
| CVE-2026-41383 | 8.1 HIGH | OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths |
| CVE-2026-42432 | 7.8 HIGH | OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass |
| CVE-2026-41387 | 7.8 HIGH | OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitizati |
| CVE-2026-41384 | 7.8 HIGH | OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend |
| CVE-2026-41396 | 7.8 HIGH | OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root |
| CVE-2026-41912 | 7.6 HIGH | OpenClaw < 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered |
| CVE-2026-41399 | 7.5 HIGH | OpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades |
| CVE-2026-41395 | 7.5 HIGH | OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3 |
| CVE-2026-41405 | 7.5 HIGH | OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsi |
| CVE-2026-42423 | 7.5 HIGH | OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallb |
| CVE-2026-41380 | 7.3 HIGH | OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables |
| CVE-2026-41390 | 7.3 HIGH | OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: OpenClaw
-
CVE-2026-102807
OpenClaw before 2026.9.4 Authorization Bypass via MCP App St -
CVE-2026-102806
OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media -
CVE-2026-100599
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via -
CVE-2026-100598
OpenClaw before 2026.7.1 Approval Binding Logic Error -
CVE-2026-100597
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
Same vendor: OpenClaw
-
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 Remote Code Execution -
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.prese -
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution -
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service -
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
Same weakness: CWE-59
-
CVE-2026-103263
Tornado before 6.5.9 StaticFileHandler Path Traversal via Sy -
CVE-2026-102113
Kiteworks Core Local Privilege Escalation -
CVE-2026-102118
Kiteworks Core before version 9.5.0 is vulnerable to Local P -
CVE-2026-81310
Linux图像扫描驱动存在链接跟随漏洞 -
CVE-2026-102242
Path Traversal via Symlink Following in allowedLocalRoots in
V. Comments for CVE-2026-41397
No comments yet