OpenClaw versions before 2026.6.9 have a symlink following vulnerability in the mirror sync feature. This flaw allows lower-trust callers to perform actions that normally require stronger authorization by exploiting remote symlink parents. The vulnerability can bypass policy checks and authorization boundaries when the feature is enabled and accessible.