CVE-2026-62189CWE-367CWE-59

OpenClaw < 2026.6.9 Symlink Following via Mirror Sync

High · published July 13, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00375 · 30.3th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-07-13T21:30Z
EPSS history
Timeline
  • 13 JUL 21:30Z
    OpenClaw < 2026.6.9 Symlink Following via Mirror Sync
    cvelistv5