CVE-2026-43529: OpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator
OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the target file between validation and preflight read, causing the validator to inspect a different file identity than the one that passed the initial boundary check.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43529?
CVE-2026-43529 is classified as a medium severity vulnerability due to its potential to allow local attackers to bypass workspace boundary checks.
How do I fix CVE-2026-43529?
To mitigate CVE-2026-43529, upgrade to OpenClaw version 2026.4.10 or later which addresses the vulnerability.
What kind of attack is enabled by CVE-2026-43529?
CVE-2026-43529 enables local attackers to exploit a time-of-check-time-of-use race condition in the exec Script Preflight Validator.
Which versions of OpenClaw are affected by CVE-2026-43529?
CVE-2026-43529 affects all versions of OpenClaw prior to 2026.4.10.
What component of OpenClaw is affected by CVE-2026-43529?
CVE-2026-43529 affects the validateScriptFileForShellBleed function within the exec Script Preflight Validator component.