# CVE-2026-44113/44112 Sandbox Escape File Access

- **Severity:** Critical
- **Signature ID:** `netzilo-cve-2026-44113-44112-001`
- **CVEs:** CVE-2026-44112, CVE-2026-44113
- **MITRE ATLAS:** AML.T0105 (Escape to Host), AML.T0097 (Virtualization/Sandbox Evasion)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution)

## Summary

Two related flaws (CVE-2026-44113 and CVE-2026-44112) let a process escape the OpenClaw sandbox by exploiting a timing gap between a security check and the actual file access. This lets an attacker or compromised agent reach files outside the directory it was supposed to be confined to, either reading sensitive data or writing to unauthorized locations.

## How the attack works

OpenClaw sandboxes are meant to restrict file operations to a specific mount root. The vulnerability is a time-of-check-to-time-of-use (TOCTOU) race: the sandbox validates that a path is inside the allowed root, but the actual file operation happens slightly later, leaving a window where the target can be swapped (e.g. via a symlink) to point outside the sandbox. CVE-2026-44113 abuses this to read files outside the mount root; CVE-2026-44112 abuses it to write files outside the mount root. The escape can be triggered either directly through the agent's file-access tool calls or indirectly by spawning a subprocess (such as a shell) that performs the file access on the attacker's behalf.

## Why it matters

An attacker who controls or influences agent input can exfiltrate files outside the sandbox (credentials, configs, other tenants' data) or write/overwrite files outside it, potentially achieving persistence or further compromise of the host.

## What you can do

- Restrict what the host filesystem actually exposes to the sandbox process — do not rely on the sandbox boundary alone for sensitive data separation.
- Monitor and alert on file operations by the agent or its subprocesses that resolve to paths outside the intended mount root.
- Avoid granting the agent's runtime the ability to spawn arbitrary shells or subprocesses if not strictly required.
- Review recent file access logs for reads or writes outside the sandbox root, especially around symlink creation or path resolution just before file operations.

## Known benign look-alikes

- None expected for out-of-sandbox access to sensitive paths

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-44113
- https://nvd.nist.gov/vuln/detail/CVE-2026-44112

---
Source: https://www.netzilo.com/threats/openclaw-cve-2026-44113-44112-sandbox-escape