CVE-2026-27545
OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current working directory…
Does this matter?
Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own.
Description
OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current working directory after approval. An attacker can modify mutable parent symlink path components between approval and execution time to redirect command execution to a different location while preserving the visible working directory string.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.10% probability · 1th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-367
- Affected
- openclaw/openclaw
- Source
- disclosure@vulncheck.com
References
- https://github.com/openclaw/openclaw/commit/4b4718c8dfce2e2c48404aa5088af7c013bed60bPatch
- https://github.com/openclaw/openclaw/commit/4e690e09c746408b5e27617a20cb3fdc5190dbdaPatch
- https://github.com/openclaw/openclaw/commit/78a7ff2d50fb3bcef351571cb5a0f21430a340c1Patch
- https://github.com/openclaw/openclaw/commit/d06632ba45a8482192792c55d5ff0b2e21abb0a7Patch
- https://github.com/openclaw/openclaw/commit/d82c042b09727a6148f3ca651b254c4a677aff26Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-f7ww-2725-qvw2Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-parent-symlink-current-working-directory-rebindThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.