A critical time-of-check time-of-use (TOCTOU) race condition in OpenClaw allows local attackers to achieve arbitrary code execution by tampering with script files during the runtime process.

This vulnerability is a Time-of-check Time-of-use (CWE-367) race condition. It allows a local user with low privileges to modify scripts after they have been approved but before they are executed, resulting in unintended code execution as the OpenClaw runtime user.

Successful exploitation permits a local attacker to execute arbitrary code with the permissions of the OpenClaw runtime user. This can lead to full system compromise, unauthorized data access, and the potential for privilege escalation within the host environment. Given the CVSS score of 7.3, this flaw represents a significant risk to the integrity and availability of the application.

Immediate Action: Update the OpenClaw package to version 2026.3.11 or later immediately to resolve the race condition.

Proactive Monitoring: Monitor system logs for unexpected file modifications or unauthorized script execution attempts in the directory where OpenClaw processes approved scripts.

Compensating Controls: Restrict filesystem permissions on directories containing scripts to ensure that only the necessary service accounts have write access, thereby limiting the ability of local users to perform the file replacement.

Public Exploit Available: Unknown

The vulnerability poses a severe risk to local system security by allowing unauthorized code execution. Administrators should prioritize upgrading to version 2026.3.11 to patch the underlying race condition. Failure to update leaves the system exposed to local privilege escalation and potential full system compromise.