Every CVE Search/ Get API key

CVE-2026-32043

OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter

5.9 MediumFix available

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
High

Exploit likelihood

0.10%Up 0.1 points since Mar 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Record
CVE-2026-32043
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-367
Updated
2026-11-02
EUVDEUVD-2026-13935 5.9

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Record
EUVD-2026-13935
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3p2x-hjxj-c7rv 5.9

Duplicate Advisory: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mwcg-wfq3-4gjc. This link is maintained to preserve external references.

Original Description

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Record
GHSA-3p2x-hjxj-c7rv
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-367
Updated
2026-11-02
GitHub AdvisoriesGHSA-mwcg-wfq3-4gjc 5.9

OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

Summary

In [email protected], approval-bound system.run on node hosts could be influenced by mutable symlink cwd targets between approval and execution.

Details

Approval matching on the gateway validated command/argv and binding fields, including cwd, as provided text. Node execution later used runtime cwd resolution. A symlinked cwd could therefore be retargeted after approval and before spawn.

OpenClaw's trust model does not treat one shared gateway as a multi-tenant adversarial boundary, but approval integrity is still a security boundary for operator-reviewed command execution.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.24
  • Patched: >= 2026.2.25

Fix Commit(s)

  • f789f880c934caa8be25b38832f27f90f37903db

Remediation

The fix adds defense-in-depth hardening for approval-bound node execution:

  • reject symlink cwd paths for approval-bound system.run
  • canonicalize path-like executable argv before spawn
  • bind CLI approval requests to exact commandArgv

Release Process Note

Patched version is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-mwcg-wfq3-4gjc
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-59, CWE-367
Updated
2026-11-02
NVD 5.9

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Record
CVE-2026-32043
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-367
Updated
2026-11-02
OSV 5.9

OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Record
CVE-2026-32043
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-367
Updated
2026-11-02
OSVGHSA-3p2x-hjxj-c7rv 5.9

Duplicate Advisory: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mwcg-wfq3-4gjc. This link is maintained to preserve external references.

Original Description

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.

Record
GHSA-3p2x-hjxj-c7rv
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-367
Updated
2026-11-02
OSVGHSA-mwcg-wfq3-4gjc 5.9

OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

Summary

In [email protected], approval-bound system.run on node hosts could be influenced by mutable symlink cwd targets between approval and execution.

Details

Approval matching on the gateway validated command/argv and binding fields, including cwd, as provided text. Node execution later used runtime cwd resolution. A symlinked cwd could therefore be retargeted after approval and before spawn.

OpenClaw's trust model does not treat one shared gateway as a multi-tenant adversarial boundary, but approval integrity is still a security boundary for operator-reviewed command execution.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.24
  • Patched: >= 2026.2.25

Fix Commit(s)

  • f789f880c934caa8be25b38832f27f90f37903db

Remediation

The fix adds defense-in-depth hardening for approval-bound node execution:

  • reject symlink cwd paths for approval-bound system.run
  • canonicalize path-like executable argv before spawn
  • bind CLI approval requests to exact commandArgv

Release Process Note

Patched version is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-mwcg-wfq3-4gjc
CVSS 4.0
5.9 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-367, CWE-59
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 through 2026.2.24
2026.2.25
openclaw
npm
 before 2026.2.25
2026.2.25

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32043 is a medium vulnerability (CVSS 5.9) in Openclaw, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 1st percentile. Fixed in openclaw 2026.2.25.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open