Executive brief
OpenClaw is a platform for managing and executing approved system commands across node hosts. A vulnerability in its command approval system allows an attacker to retarget a symbolic link between the approval check and actual execution, causing approved commands to run in an unintended directory. This enables attackers to execute arbitrary commands on the node hosts, potentially compromising the integrity and availability of systems managed by OpenClaw.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in the approval-bound system.run execution flow. The gateway validates the cwd (current working directory) parameter as provided text at approval time, but node execution later performs runtime cwd resolution, allowing symlinked cwd paths to be retargeted after approval and before process spawning. An attacker with local access can modify a symlink target between approval and execution to cause the command to run in a different directory, bypassing command execution restrictions. The fix adds defense-in-depth hardening by rejecting symlink cwd paths for approval-bound system.run and canonicalizing path-like executable argv before spawn. Patched in version 2026.2.25.
Affected products
- OpenClaw openclaw <2026.2.25
Timeline
- 2026-02-26: disclosed: Security advisory published
- 2026-02-26: patched: Fix committed as f789f880c934caa8be25b38832f27f90f37903db
- 2026-03-21: advisory: GHSA-3p2x-hjxj-c7rv published (duplicate)