What’s Vulnerable › Vulnerabilities

CVE-2026-27523: OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-18 · updated 2026-06-17
• Weakness: CWE-22

Description

OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via symlinked parent directories with non-existent leaf paths. Attackers can craft bind source paths that appear within allowed roots but resolve outside sandbox boundaries once missing leaf components are created, weakening bind-source isolation enforcement.

Affected products

• OpenClaw: before 2026.2.24 — fixed in 2026.2.24

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.24. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/b5787e4abba0dcc6baf09051099f6773c1679ec1
• https://github.com/openclaw/openclaw/security/advisories/GHSA-m8v2-6wwh-r4gc
• https://www.vulncheck.com/advisories/openclaw-sandbox-bind-validation-bypass-via-symlink-parent-missing-leaf-paths

Get alerted when CVE-2026-27523 or the next vulnerability affects your stack