CVE-2026-62189: OpenClaw symlink following bypasses

CISO Take

OpenClaw's mirror sync feature resolves symlinks before re-validating the caller's authorization, letting a low-privileged caller point a mirror sync at a remote symlink parent and land writes inside paths that gate stronger permissions — effectively forging its way past OpenClaw's own policy checks. This matters because OpenClaw is an AI agent framework: an authorization bypass here doesn't just leak a file, it can let a low-trust caller trigger agent actions that should require elevated trust, with confidentiality and integrity impact rated High (CVSS 7.1, AV:N/PR:L/UI:N). There's no public exploit or Nuclei template yet, it isn't in CISA KEV, and EPSS sits at 0.00246 (top 84th percentile — moderate, not urgent), but the package already carries 447 other CVEs and a 0/100 risk score, so this isn't an isolated slip. Patch to OpenClaw 2026.6.9 or later now; if you can't patch immediately, disable mirror sync and audit any storage paths it touches for symlinks you don't control.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

High severity (CVSS 7.1) but currently moderate real-world risk: exploitation requires high attack complexity (AC:H) — the attacker must win a TOCTOU race and control a symlink parent reachable by the mirror sync feature — plus low privileges on the target OpenClaw deployment. No public PoC, no Nuclei template, and no CISA KEV listing lower near-term exploitation likelihood, and EPSS (0.00246) confirms this. However, the impact ceiling is high: successful exploitation grants a low-trust caller actions normally gated behind stronger authorization inside an AI agent framework, which can cascade into broader agent misuse. The package's poor overall security posture (0/100 risk score, 447 prior CVEs) argues for treating this as a priority patch rather than a backlog item, especially for internet-reachable deployments with the mirror sync feature enabled.

How does the attack unfold?

Initial Access

A low-privilege caller (scoped API key, limited agent session, or third-party integration) gains network-reachable access to an OpenClaw instance with the mirror sync feature enabled.

AML.T0049

Exploitation

The caller triggers mirror sync against a path whose parent is an attacker-controlled remote symlink; OpenClaw follows the symlink before re-validating authorization (CWE-59/CWE-367).

AML.T0107

Authorization Bypass

The resulting write lands inside a path OpenClaw treats as protected, letting the low-trust caller circumvent the policy checks that should gate stronger-authorization actions.

AML.T0081

Impact

The attacker leverages the forged authorization to perform agent actions or tool invocations normally restricted to higher-trust callers, risking data exposure and unauthorized agent operations.

AML.T0053

Initial Access

A low-privilege caller (scoped API key, limited agent session, or third-party integration) gains network-reachable access to an OpenClaw instance with the mirror sync feature enabled.

AML.T0049

Exploitation

The caller triggers mirror sync against a path whose parent is an attacker-controlled remote symlink; OpenClaw follows the symlink before re-validating authorization (CWE-59/CWE-367).

AML.T0107

Authorization Bypass

The resulting write lands inside a path OpenClaw treats as protected, letting the low-trust caller circumvent the policy checks that should gate stronger-authorization actions.

AML.T0081

Impact

The attacker leverages the forged authorization to perform agent actions or tool invocations normally restricted to higher-trust callers, risking data exposure and unauthorized agent operations.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A Low

What should I do?

1 step

1) Upgrade to OpenClaw 2026.6.9 or later immediately — this is the primary fix. 2) If patching must wait, disable the mirror sync feature entirely via configuration, especially in any deployment serving lower-trust or multi-tenant callers. 3) Where mirror sync must stay enabled, restrict it to trusted, single-tenant storage paths and avoid backends where external parties can create symlinks (shared mounts, user-writable directories). 4) Audit filesystem ACLs and existing symlinks on any directory reachable by mirror sync operations. 5) Review authorization/audit logs for anomalous privilege usage correlated with mirror sync activity. 6) Consult GHSA-m38g-vpwj-mpg9 and the VulnCheck advisory for any published indicators of compromise.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.8 - AI system operation and monitoring

NIST AI RMF

GOVERN 1.5 - Risk management processes are monitored and reviewed, with defined roles for cybersecurity risk integration

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62189?

OpenClaw's mirror sync feature resolves symlinks before re-validating the caller's authorization, letting a low-privileged caller point a mirror sync at a remote symlink parent and land writes inside paths that gate stronger permissions — effectively forging its way past OpenClaw's own policy checks. This matters because OpenClaw is an AI agent framework: an authorization bypass here doesn't just leak a file, it can let a low-trust caller trigger agent actions that should require elevated trust, with confidentiality and integrity impact rated High (CVSS 7.1, AV:N/PR:L/UI:N). There's no public exploit or Nuclei template yet, it isn't in CISA KEV, and EPSS sits at 0.00246 (top 84th percentile — moderate, not urgent), but the package already carries 447 other CVEs and a 0/100 risk score, so this isn't an isolated slip. Patch to OpenClaw 2026.6.9 or later now; if you can't patch immediately, disable mirror sync and audit any storage paths it touches for symlinks you don't control.

Is CVE-2026-62189 actively exploited?

No confirmed active exploitation of CVE-2026-62189 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62189?

1) Upgrade to OpenClaw 2026.6.9 or later immediately — this is the primary fix. 2) If patching must wait, disable the mirror sync feature entirely via configuration, especially in any deployment serving lower-trust or multi-tenant callers. 3) Where mirror sync must stay enabled, restrict it to trusted, single-tenant storage paths and avoid backends where external parties can create symlinks (shared mounts, user-writable directories). 4) Audit filesystem ACLs and existing symlinks on any directory reachable by mirror sync operations. 5) Review authorization/audit logs for anomalous privilege usage correlated with mirror sync activity. 6) Consult GHSA-m38g-vpwj-mpg9 and the VulnCheck advisory for any published indicators of compromise.

What systems are affected by CVE-2026-62189?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool orchestration, agent configuration management.

What is the CVSS score for CVE-2026-62189?

CVE-2026-62189 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool orchestrationagent configuration management

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.8

NIST AI RMF: GOVERN 1.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

Exploitation Scenario

A low-privilege caller with scoped access to an OpenClaw deployment — for example a limited API key or a restricted third-party skill/integration — invokes the mirror sync feature and targets a path whose parent directory is a symlink under the attacker's control, pointing back into a directory OpenClaw treats as protected (e.g., its policy or authorization configuration). Because the sync logic follows the symlink before re-checking the caller's authorization (CWE-59 improper link resolution combined with the CWE-367 TOCTOU race), the attacker's low-trust write lands inside the protected path. The attacker then uses this to alter or circumvent the authorization checks OpenClaw's agent runtime relies on, allowing them to invoke agent actions or tools that should have required a higher-trust caller.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Primary CWE-59 Improper Link Resolution Before File Access ('Link Following') Primary CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.