What’s Vulnerable › Vulnerabilities

CVE-2026-27545: OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-18 · updated 2026-06-17
• Weakness: CWE-367

Description

OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current working directory after approval. An attacker can modify mutable parent symlink path components between approval and execution time to redirect command execution to a different location while preserving the visible working directory string.

Affected products

• OpenClaw: before 2026.2.26 — fixed in 2026.2.26

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.26. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/4b4718c8dfce2e2c48404aa5088af7c013bed60b
• https://github.com/openclaw/openclaw/commit/4e690e09c746408b5e27617a20cb3fdc5190dbda
• https://github.com/openclaw/openclaw/commit/78a7ff2d50fb3bcef351571cb5a0f21430a340c1
• https://github.com/openclaw/openclaw/commit/d06632ba45a8482192792c55d5ff0b2e21abb0a7
• https://github.com/openclaw/openclaw/commit/d82c042b09727a6148f3ca651b254c4a677aff26
• https://github.com/openclaw/openclaw/security/advisories/GHSA-f7ww-2725-qvw2
• https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-parent-symlink-current-working-directory-rebind

Get alerted when CVE-2026-27545 or the next vulnerability affects your stack