CVE-2026-27545: OpenClaw symlink race bypasses

CISO Take

OpenClaw's human-approval gate for the system.run tool can be defeated by an attacker who rebinds a writable parent symlink in the working-directory path after a command is approved but before it executes, so the agent runs against a different filesystem location than the one the approver actually reviewed. This matters because approval-before-execution is the core safety control organizations rely on to trust autonomous coding/dev agents with shell access — defeating it silently turns a supposedly human-gated action into an unattended one. The near-term risk is nonetheless limited: EPSS is 0.00095 (negligible real-world exploitation probability), there is no public exploit or Nuclei template, it is absent from CISA KEV, and CISA's own SSVC decision is TRACK, its lowest actionable tier, with only 4 downstream dependents recorded. Local access and low privileges are still required, so this is realistically a malicious-insider, compromised-shared-host, or poisoned-skill/dependency threat rather than a remote one. Action: upgrade to OpenClaw 2026.2.26+ immediately wherever system.run approvals gate access to sensitive paths, and add detection for rapid symlink swaps on directories referenced by pending or recent agent approvals.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 6.1) reflects a high-integrity-impact but low-exploitability profile: attack vector is local, complexity low, but it requires an attacker already present on the host with low privileges (e.g., a malicious skill, compromised low-priv account, or shared multi-tenant dev environment) and precise timing to win the TOCTOU race between approval and execution. EPSS (0.00095) and SSVC TRACK both indicate negligible observed/predicted real-world exploitation, and there is no public PoC or scanner signature, so this is not an urgent breaking-alert item. However, it directly undermines an AI agent's core safety control (human approval), which is a disproportionately sensitive target — a successful bypass converts a reviewed, scoped action into an attacker-redirected one without the approver's knowledge, which is a meaningfully different risk class than a generic local file-write bug.

How does the attack unfold?

Precondition: local low-privilege foothold

Attacker obtains local, low-privileged access to a host running OpenClaw (e.g., shared dev box, compromised account, or malicious skill) with write access to a symlinked parent path component.

Approval granted

A legitimate user approves an OpenClaw system.run command based on the displayed current working directory string.

AML.T0053

TOCTOU symlink rebind

Between approval and execution, the attacker rewrites the writable parent symlink so the same displayed path now resolves to a different, attacker-chosen location.

AML.T0107

Redirected execution / impact

OpenClaw executes the approved command against the attacker-controlled location, achieving unauthorized command execution and integrity impact while the approval trail still shows the original, benign path.

AML.T0050

Precondition: local low-privilege foothold

Attacker obtains local, low-privileged access to a host running OpenClaw (e.g., shared dev box, compromised account, or malicious skill) with write access to a symlinked parent path component.

Approval granted

A legitimate user approves an OpenClaw system.run command based on the displayed current working directory string.

AML.T0053

TOCTOU symlink rebind

Between approval and execution, the attacker rewrites the writable parent symlink so the same displayed path now resolves to a different, attacker-chosen location.

AML.T0107

Redirected execution / impact

OpenClaw executes the approved command against the attacker-controlled location, achieving unauthorized command execution and integrity impact while the approval trail still shows the original, benign path.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

1) Patch: upgrade OpenClaw to 2026.2.26 or later, which fixes the approval/execution path resolution across the five linked commits. 2) Workaround if patching is delayed: avoid granting system.run approval in directories with writable parent path components controllable by lower-privileged users or untrusted skills; resolve and canonicalize (realpath) the working directory at approval time and re-verify it is unchanged immediately before execution. 3) Detection: monitor for filesystem events that modify symlinks in directories referenced by recently-approved or pending agent commands, and audit OpenClaw execution logs for discrepancies between the approved path string and the resolved path actually used at execution time. 4) Reduce blast radius: run agents with system.run capability under dedicated low-privilege service accounts with restricted write access to shared/parent directories, limiting who can plant a malicious symlink in the first place.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.7 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-27545?

OpenClaw's human-approval gate for the system.run tool can be defeated by an attacker who rebinds a writable parent symlink in the working-directory path after a command is approved but before it executes, so the agent runs against a different filesystem location than the one the approver actually reviewed. This matters because approval-before-execution is the core safety control organizations rely on to trust autonomous coding/dev agents with shell access — defeating it silently turns a supposedly human-gated action into an unattended one. The near-term risk is nonetheless limited: EPSS is 0.00095 (negligible real-world exploitation probability), there is no public exploit or Nuclei template, it is absent from CISA KEV, and CISA's own SSVC decision is TRACK, its lowest actionable tier, with only 4 downstream dependents recorded. Local access and low privileges are still required, so this is realistically a malicious-insider, compromised-shared-host, or poisoned-skill/dependency threat rather than a remote one. Action: upgrade to OpenClaw 2026.2.26+ immediately wherever system.run approvals gate access to sensitive paths, and add detection for rapid symlink swaps on directories referenced by pending or recent agent approvals.

Is CVE-2026-27545 actively exploited?

No confirmed active exploitation of CVE-2026-27545 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27545?

1) Patch: upgrade OpenClaw to 2026.2.26 or later, which fixes the approval/execution path resolution across the five linked commits. 2) Workaround if patching is delayed: avoid granting system.run approval in directories with writable parent path components controllable by lower-privileged users or untrusted skills; resolve and canonicalize (realpath) the working directory at approval time and re-verify it is unchanged immediately before execution. 3) Detection: monitor for filesystem events that modify symlinks in directories referenced by recently-approved or pending agent commands, and audit OpenClaw execution logs for discrepancies between the approved path string and the resolved path actually used at execution time. 4) Reduce blast radius: run agents with system.run capability under dedicated low-privilege service accounts with restricted write access to shared/parent directories, limiting who can plant a malicious symlink in the first place.

What systems are affected by CVE-2026-27545?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, autonomous coding/dev agents, local AI agent tool execution, CI/CD-adjacent automation agents.

What is the CVSS score for CVE-2026-27545?

CVE-2026-27545 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.10%.

What is the AI security impact?

Affected AI Architectures

agent frameworksautonomous coding/dev agentslocal AI agent tool executionCI/CD-adjacent automation agents

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.7

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current working directory after approval. An attacker can modify mutable parent symlink path components between approval and execution time to redirect command execution to a different location while preserving the visible working directory string.

Exploitation Scenario

A low-privileged local user or a malicious third-party 'skill' running with limited permissions on a shared development host notices that a legitimate OpenClaw agent session is about to request approval to run a command in a project directory whose parent path includes a symlink the attacker can write to. Once the approver reviews and approves the command based on the displayed working-directory string, the attacker quickly rewrites that parent symlink to point elsewhere before the agent actually invokes system.run, causing the command to execute against attacker-controlled files or a different sensitive directory (e.g., one containing credentials or CI secrets) while the approver believed they authorized a benign, well-scoped action. The result is unauthorized command execution with the integrity of the approval process itself compromised, without any indication in the UI that redirection occurred.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.