Race Condition Vulnerability in OpenClaw by OpenClaw

CVE-2026-100597

What is CVE-2026-100597?

OpenClaw versions prior to 2026.7.1 are susceptible to a race condition affecting local mirror filesystem mutations. This vulnerability allows an attacker to exploit timing discrepancies during the execution of operations like remove, mkdir, and rename. If an internal path check is bypassed due to concurrent modifications, unauthorized file actions can occur outside the sandboxed environment. This issue occurs without needing explicit permissions for host filesystem access, allowing potentially damaging operations to be executed within the privileges of the OpenClaw process.

References