Openclaw cli: OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths (CVE-2026-27523)

In OpenClaw CLI versions up to and including 2026.2.23, the sandbox bind-source validation mechanism could be bypassed when a bind source path used a symlinked parent directory with a missing leaf path. The validation function `validateBindMounts` relied on full-path realpath only if the full source path existed. For missing leaf paths, the parent symlink traversal was not fully canonicalized before checking against allowed roots and blocked runtime paths. This allowed a source path that appeared to be inside an allowed root to actually resolve outside that root once the missing leaf was created, weakening sandbox boundary enforcement. The fix, released in 2026.2.24, ensures canonicalization through the nearest existing ancestor and re-checks the canonical path against allowed roots and blocked paths.

The vulnerability weakens sandbox bind-source boundary enforcement by allowing paths that appear to be within allowed roots to resolve outside those roots, including blocked runtime paths. This could potentially allow unauthorized access or manipulation of filesystem locations that should be restricted by the sandbox. No known exploits in the wild have been reported.

A patch is available in OpenClaw CLI version 2026.2.24. Users should upgrade to version 2026.2.24 or later to remediate this vulnerability. The fix improves path canonicalization and validation logic to prevent bypass via symlinked parent directories with missing leaf paths.