CVE-2026-27545: Openclaw Auth Bypass Vulnerability

CVE-2026-27545 Overview

CVE-2026-27545 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability affecting OpenClaw versions prior to 2026.2.26. The vulnerability exists in the system.run execution approval mechanism, allowing attackers to bypass security controls by manipulating writable parent symlinks in the current working directory after approval has been granted. By modifying mutable parent symlink path components between the approval and execution phases, an attacker can redirect command execution to an unintended filesystem location while the visible working directory string remains unchanged.

Critical Impact
Attackers with local access can bypass OpenClaw's command execution approval system, potentially executing arbitrary commands from unauthorized filesystem locations, leading to integrity compromise and possible unauthorized actions.

Affected Products

OpenClaw versions prior to 2026.2.26
OpenClaw for Node.js (all vulnerable versions)

Discovery Timeline

2026-03-18 - CVE-2026-27545 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-27545

Vulnerability Analysis

This vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition). The flaw resides in the approval workflow for the system.run command within OpenClaw's gateway component. When a command execution is requested, the system validates the working directory and grants approval based on the resolved path at that moment. However, the system fails to re-validate the path at actual execution time, creating a window of opportunity for exploitation.

The core issue is that parent symlink components in the current working directory path can be modified by an attacker after the approval check but before the actual command execution. Since the approval binding captures only the string representation of the path rather than canonicalizing and locking it, an attacker with write access to any parent directory can rebind a symlink to point to a different location.

Root Cause

The root cause is insufficient path canonicalization and validation during the approval-to-execution lifecycle. The system.run approval mechanism stores the working directory as a mutable path string without resolving symlinks to their real filesystem paths or implementing proper path locking mechanisms. This allows the resolved path to change between the security check and the privileged operation.

Attack Vector

This is a local attack vector requiring the attacker to have low privileges on the affected system. The attacker must have write access to a parent directory component that can be converted to or already contains a symlink. The attack sequence involves:

Requesting command execution approval for a legitimate working directory
Receiving approval for the apparent path
Modifying a parent symlink to redirect to a malicious location
Having the command execute in the attacker-controlled location while the approval remains valid

typescript

// Security patch centralizing approval context and error handling
// Source: https://github.com/openclaw/openclaw/commit/4e690e09c746408b5e27617a20cb3fdc5190dbda

export type SystemRunApprovalGuardError = {
  ok: false;
  message: string;
  details: Record<string, unknown>;
};

export function systemRunApprovalGuardError(params: {
  code: string;
  message: string;
  details?: Record<string, unknown>;
}): SystemRunApprovalGuardError {
  const details = params.details ? { ...params.details } : {};
  return {
    ok: false,
    message: params.message,
    details: {
      code: params.code,
      ...details,
    },
  };
}

export function systemRunApprovalRequired(runId: string): SystemRunApprovalGuardError {
  return systemRunApprovalGuardError({
    code: "APPROVAL_REQUIRED",
    message: "approval required",
    details: { runId },
  });
}

typescript

// Additional hardening adding system.run.prepare to system commands
// Source: https://github.com/openclaw/openclaw/commit/78a7ff2d50fb3bcef351571cb5a0f21430a340c1

const SYSTEM_COMMANDS = [
  "system.run.prepare",
  "system.run",
  "system.which",
  "system.notify",
  "browser.proxy",
];

Detection Methods for CVE-2026-27545

Indicators of Compromise

Unexpected symlink modifications in directories used as working directories for OpenClaw commands
File system audit logs showing rapid symlink creation or modification followed by system.run executions
Command executions that resolve to different filesystem locations than the approved paths
Anomalous command execution patterns where the logged working directory differs from the actual execution location

Detection Strategies

Implement file integrity monitoring on directories commonly used as working directories for OpenClaw
Monitor for symlink creation or modification events using auditd or similar system auditing tools
Deploy SentinelOne Singularity Platform to detect anomalous process execution and symlink manipulation patterns
Correlate approval logs with execution logs to identify discrepancies in resolved paths

Monitoring Recommendations

Enable detailed filesystem auditing for symlink operations using the auditd subsystem on Linux systems
Configure SentinelOne behavioral AI to alert on rapid symlink modifications followed by child process spawning
Implement centralized logging for OpenClaw gateway approval and execution events to enable forensic analysis
Monitor for processes executing from unexpected filesystem locations relative to their approved working directories

How to Mitigate CVE-2026-27545

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.26 or later immediately
Review recent system.run execution logs for signs of exploitation
Audit filesystem permissions to restrict write access to parent directories used in OpenClaw operations
Consider implementing read-only filesystem mounts for sensitive directories until patching is complete

Patch Information

The vendor has released multiple security patches addressing this vulnerability. The fixes centralize the approval context handling and implement proper path validation to prevent symlink rebinding attacks. Key commits include:

GitHub Commit #1 - Initial fix
GitHub Commit #2 - Centralized approval context
GitHub Commit #3 - Symlink rebind hardening
GitHub Commit #4 - Additional hardening
GitHub Commit #5 - Final fixes

For complete details, see the GitHub Security Advisory GHSA-f7ww-2725-qvw2.

Workarounds

Restrict write permissions on all parent directories in paths used for OpenClaw command execution
Configure OpenClaw to operate only within directories that do not contain symlinks in the path hierarchy
Implement mandatory access control (SELinux/AppArmor) policies to prevent symlink manipulation in critical directories
Use bind mounts instead of symlinks for directory structures accessed by OpenClaw

bash

# Example: Restrict symlink creation in OpenClaw working directories
# Ensure only root can create symlinks in the parent directory
chmod 755 /path/to/openclaw/workdir
chown root:root /path/to/openclaw/workdir

# Configure auditd to monitor symlink operations
auditctl -w /path/to/openclaw/workdir -p wa -k openclaw_symlink_monitor