# CVE-2026-27523: openclaw — Fixed in 2026.2.24

📦 npm

Not in CISA KEV

# CVE-2026-27523 — openclaw

[Fix: openclaw/openclaw@b5787e4](https://github.com/openclaw/openclaw/commit/b5787e4abba0dcc6baf09051099f6773c1679ec1)

CVE-2026-27523 is a Path Traversal vulnerability in openclaw. A fix is available for openclaw — see the affected versions and patch details below.

OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths

Also known as[GHSA-m8v2-6wwh-r4gc](/vulnerability/GHSA-m8v2-6wwh-r4gc)

Published

Mar 18, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27523.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.3%probability of exploitation in next 30 days

Lower Risk+0.01%

Lower risk than most CVEs19th percentile — riskier than 19% of all scored CVEsHighest risk

0.00%0.29%0.59%0.88%0.1%0.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

133other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

`openclaw`npm

2.4Mdownloads / week

## Description

#### Summary

In `openclaw` up to and including **2026.2.23** (latest npm release as of **February 24, 2026**), sandbox bind-source validation could be bypassed when a bind source used a symlinked parent plus a non-existent leaf path.

#### Affected Packages / Versions

-   Package: `openclaw` (npm)
-   Affected: `<= 2026.2.23`
-   Patched: `>= 2026.2.24` (planned next release)

#### Root Cause

`validateBindMounts` previously relied on full-path realpath only when the full source path already existed. For missing-leaf paths, parent symlink traversal was not fully canonicalized before allowed-root and blocked-path checks.

#### Security Impact

A source path that looked inside an allowed root could resolve outside that root (including blocked runtime paths) once the missing leaf was created, weakening sandbox bind-source boundary enforcement.

#### Fix

The validation path now canonicalizes through the nearest existing ancestor, then always re-checks the canonical path against both:

-   allowed source roots
-   blocked runtime paths

#### Verification

-   `pnpm check`
-   `pnpm exec vitest run --config vitest.gateway.config.ts`
-   `pnpm test:fast`
-   Added regression tests for symlink-parent + missing-leaf bypass patterns.

#### Fix Commit(s)

-   `b5787e4abba0dcc6baf09051099f6773c1679ec1`

#### Release Process Note

`patched_versions` is pre-set to the planned next release (`2026.2.24`) so after npm publish the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

#### Publication Update (2026-02-25)

`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

📦npm

`openclaw` 

all versions

2026.2.24`npm install openclaw@2026.2.24`

## Affected Products

1 product · 1 configurations

Application

`openclaw`openclaw

< 2026.2.24

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update openclaw to 2026.2.24 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-27523 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
    

## Frequently Asked Questions

\### Summary In \`openclaw\` up to and including \*\*2026.2.23\*\* (latest npm release as of \*\*February 24, 2026\*\*), sandbox bind-source validation could be bypassed when a bind source used a symlinked parent plus a non-existent leaf path. ### Affected Packages / Versions - Package: \`openclaw\` (npm) - Affected: \`<= 2026.2.23\` - Patched: \`>= 2026.2.24\` (planned next release) ### Root Cause \`validateBindMounts\` previously relied on full-path realpath only when the full source path already existed. For missing-leaf paths, parent symlink traversal was not fully canonicalized before allowed-root and blo

O3 Security · Impact-Aware SCA

### Is CVE-2026-27523 in your dependencies?

Find it across npm, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)