Executive brief
OpenClaw is a platform for managing and executing operator-reviewed commands on distributed systems. The vulnerability allows an attacker to circumvent command approval controls by changing a symlinked working directory between the time a command is approved and when it executes, potentially causing the command to run in an unintended location. This breaks the security boundary that ensures approved commands execute exactly as reviewed.
Technical details
This is a time-of-check-time-of-use (TOCTOU) race condition combined with symlink following (CWE-367 and CWE-59). The gateway validates the command, argv, and cwd fields as provided text at approval time, but the node execution layer performs runtime cwd resolution without re-validating. An attacker with local access to the node host can modify a symlinked cwd target between approval and execution, causing the command to execute in a different working directory than approved. The attack requires authentication (approval integration) but no user interaction and is local to the node host. The fix (version 2026.2.25+) rejects symlink cwd paths for approval-bound system.run, canonicalizes executable argv, and binds approval to exact commandArgv.
Affected products
- OpenClaw openclaw <=2026.2.24
Timeline
- 2026-03-03: disclosed: Advisory published
- 2026-02-26: patched: Fixed in version 2026.2.25