Medium severity6.1NVD Advisory· Published Mar 18, 2026· Updated Jun 17, 2026
CVE-2026-27545
CVE-2026-27545
Description
OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current working directory after approval. An attacker can modify mutable parent symlink path components between approval and execution time to redirect command execution to a different location while preserving the visible working directory string.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.26 | 2026.2.26 |
Affected products
3Patches
Vulnerability mechanics
References
9- github.com/openclaw/openclaw/commit/4b4718c8dfce2e2c48404aa5088af7c013bed60bnvdPatchWEB
- github.com/openclaw/openclaw/commit/4e690e09c746408b5e27617a20cb3fdc5190dbdanvdPatchWEB
- github.com/openclaw/openclaw/commit/78a7ff2d50fb3bcef351571cb5a0f21430a340c1nvdPatchWEB
- github.com/openclaw/openclaw/commit/d06632ba45a8482192792c55d5ff0b2e21abb0a7nvdPatchWEB
- github.com/openclaw/openclaw/commit/d82c042b09727a6148f3ca651b254c4a677aff26nvdPatchWEB
- github.com/advisories/GHSA-f7ww-2725-qvw2ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-f7ww-2725-qvw2nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-27545ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-approval-bypass-via-parent-symlink-current-working-directory-rebindnvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.