Openclaw cli: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host (CVE-2026-32043)

In [email protected] and earlier, the system.run approval process validates the cwd path as text during approval but resolves it at runtime on the node host. If the cwd is a symlink, it can be retargeted after approval but before command execution, creating a TOCTOU race condition. This undermines the integrity of the approval process, which is a security boundary for operator-reviewed commands. The patch in 2026.2.25 rejects symlink cwd paths, canonicalizes executable argv paths before spawn, and binds CLI approval requests to exact command arguments to prevent this issue.

This vulnerability could allow an attacker with limited privileges to influence the directory context of approved commands on node hosts by manipulating symlink targets between approval and execution. This may lead to execution of commands in unintended directories, potentially bypassing intended security controls tied to the approval process. However, the trust model assumes a non-adversarial shared gateway, limiting the scope of exploitation.

A fix is available in openclaw version 2026.2.25 and later. Users should upgrade to this version to mitigate the TOCTOU vulnerability. The patch rejects symlink cwd paths for approval-bound system.run commands, canonicalizes executable argument paths before execution, and binds CLI approval requests to exact command arguments. No additional mitigation actions are required beyond applying the official fix.