Arbitrary Directory Deletion in OpenClaw's Mirror Mode

CVE-2026-41383

What is CVE-2026-41383?

OpenClaw, prior to version 2026.4.2, is susceptible to an arbitrary directory deletion vulnerability when operating in mirror mode. This issue arises due to misconfigured paths—specifically, the remoteWorkspaceDir and remoteAgentWorkspaceDir settings—which attackers can exploit to manipulate OpenShell configurations. As a result, malicious actors may induce sync operations that inadvertently delete critical remote directory contents, enabling them to replace the data with potentially harmful uploaded workspace content.

References