Openclaw cli: OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind (CVE-2026-27545)

The vulnerability in OpenClaw CLI (CVE-2026-27545) affects node system.run executions with host=node. It allows bypassing the approval context after approval-time by rebinding a writable parent symlink in the cwd while preserving the visible cwd string. This means a command approved for execution in one filesystem location could be executed from a different location if a mutable parent symlink changes between approval and execution. The fix involves immutable approval-time plan preparation, canonical plan fields enforcement, and rejection of mutable parent-symlink components during approval-plan building to prevent symlink rebind bypass.

An attacker could exploit this vulnerability to execute commands from unauthorized filesystem locations by manipulating parent symlinks after command approval. This undermines the integrity of the approval process, potentially allowing execution of commands in unintended contexts, which could lead to unauthorized actions or privilege escalation within the affected environment.

A patch is available in OpenClaw CLI version 2026.2.26 and later. Users should upgrade to this version once released. The fix includes immutable approval-time plan preparation and rejection of mutable parent symlink components to prevent bypass. Until the patch is applied, users should be cautious about symlink usage in the cwd during node system.run executions.