EUVD-2026-12738
GHSA-f7ww-2725-qvw2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2021 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Impact | This vulnerability presents moderate real-world risk despite its CVSS 3.1 score of 6.1, which correctly reflects the medium severity. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) indicates: local attack vector (requires filesystem access), low attack complexity (the race condition is straightforward to execute), low privileges required, no user interaction needed, and high integrity impact with low availability impact. The vulnerability is not marked as known exploited (KEV status unknown), and no public POC is referenced in the available intelligence. However, the technical nature of TOCTOU vulnerabilities means they are highly automatable and the exploitation window, while requiring precise timing, is feasible in practice. The real-world risk is further contextualized by the fact that this requires local access (PR:L) and targets command execution approval mechanisms, making it most dangerous in multi-tenant or shared systems where OpenClaw is used for sandboxing or privilege separation. The availability of multiple vendor patches (5 commits referenced) suggests confidence in the fix but also indicates complexity in addressing the root cause comprehensively. |
| Exploit ScenarioDerived | A local user on a system running OpenClaw obtains a list of approved command executions (e.g., via logs or by submitting a command for approval). The attacker then modifies parent symlinks in the filesystem to point to a different location and re-submits a similar command, which passes approval because the symlink still resolves to the same visible path at check time. After approval is granted, the attacker quickly rebinds the symlink to a malicious location. When OpenClaw executes the command, it follows the modified symlink, executing the attacker's code in an unintended location while bypassing the approval control. This race condition requires precise timing but is highly feasible given the low attack complexity rating and the local access required to manipulate symlinks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
OpenClaw versions prior to 2026.2.26 contain a Time-of-Check-Time-of-Use (TOCTOU) approval bypass vulnerability in the system.run execution function that allows local attackers with low privileges to execute arbitrary commands from unintended filesystem locations. An attacker can exploit a race condition by modifying parent symlinks in the current working directory after command approval but before execution, redirecting execution while maintaining the appearance of a safe working directory. A patch is available from the vendor, and this vulnerability has been documented by both VulnCheck and the OpenClaw security advisory (GHSA-f7ww-2725-qvw2).
RemediationAI
Upgrade OpenClaw to version 2026.2.26 or later immediately, as patches are available from the vendor. The fix has been implemented across multiple commits (78a7ff2d50fb3bcef351571cb5a0f21430a340c1, d82c042b09727a6148f3ca651b254c4a677aff26, d06632ba45a8482192792c55d5ff0b2e21abb0a7, 4e690e09c746408b5e27617a20cb3fdc5190dbda, and 4b4718c8dfce2e2c48404aa5088af7c013bed60b) as referenced on GitHub. Until patching is possible, restrict local filesystem access to OpenClaw processes to trusted users only, implement filesystem monitoring to detect suspicious symlink modifications in working directories, and review system.run approval logs for signs of exploitation. Consult the official vendor security advisory at https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-parent-symlink-current-working-directory-rebind for additional context and validation of the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-367 (Time-of-Check-Time-of-Use / TOCTOU Race Condition), a classic class of vulnerabilities where security decisions are made based on filesystem state that can change between the decision point and the actual operation. OpenClaw (affected CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements an approval mechanism for system.run command execution that validates the intended working directory and command path at approval time. However, because the validation occurs separately from the actual command execution, and because parent directory symlinks in the filesystem are mutable and writable, an attacker with local access can modify these symlinks between the approval check and execution. This allows the actual command execution to occur in a different filesystem location than what was approved, while the displayed working directory string remains unchanged, effectively bypassing the intended authorization controls.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current working directory after approval. An attacker can modify mutable parent symlink path components between approval and execution time to redirect command execution to a different location while preserving the visible working directory string.
Blast Radius
ecosystem impact- 2 npm packages depend on openclaw (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.2.26.
Executive ViewAI
CVE-2026-27545 presents moderate security risk rated CVSS 6.1. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in OpenClaw Multiple Security Vulnerabilities
View all 4Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB