Openclaw CVE-2026-27523

The CVSS 3.1 score of 6.1 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L indicates moderate-to-high severity on a technical basis, driven by local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction needed (UI:N), and unscoped impact with high integrity violation (I:H) and low availability impact (A:L). However, real-world risk depends on deployment context. The vulnerability requires local access and standard user privileges, limiting exploitation to scenarios where an attacker already has shell access on the host—a significant gating factor. The integrity impact (I:H) is the primary concern: an attacker can write files outside the sandbox, potentially compromising system integrity, escaping container/jail boundaries, or accessing sensitive host resources. The availability impact is secondary. Exploitation is not marked as actively exploited in known exploit databases (KEV status not indicated as active), and no public POC has been widely documented in the provided references, though the vendor has published a detailed security advisory (GHSA-m8v2-6wwh-r4gc) and a patch commit (b5787e4abba0dcc6baf09051099f6773c1679ec1), suggesting internal reproduction and validation. From an SSVC perspective, exploitation is feasible (technical capability exists, no exotic tools required), likely automatable (symlink-plus-missing-path patterns are reproducible), and the technical impact is integrity-critical (sandbox escape). This elevates priority for environments using OpenClaw as a security boundary (e.g., containerization, sandboxing untrusted code). For general deployments, patch promptly but deprioritize relative to authentication or remote-code-execution vulnerabilities.

A local attacker with standard user privileges on a system running OpenClaw crafts a bind-source path such as /tmp/attacker_symlink/nonexistent_leaf, where /tmp/attacker_symlink is a symlink pointing to /sensitive_host_data. During bind validation (time-of-check), the path fails to resolve due to the missing leaf component, allowing it to pass the allowed-root and blocked-path filters. The attacker then creates the missing leaf component (e.g., via mkdir or other means), at which time the path resolves to the sensitive host directory outside the sandbox. The attacker gains access to host resources intended to be isolated, enabling data exfiltration, privilege escalation, or further lateral movement. No complex tooling is required; standard filesystem operations suffice, making this a practical risk in shared-host scenarios.