N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-m8v2-6wwh-r4gc

GHSA-m8v2-6wwh-r4gc: OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths

Summary

In openclaw up to and including 2026.2.23 (latest npm release as of February 24, 2026), sandbox bind-source validation could be bypassed when a bind source used a symlinked parent plus a non-existent leaf path.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.23
Patched: >= 2026.2.24 (planned next release)

Root Cause

validateBindMounts previously relied on full-path realpath only when the full source path already existed. For missing-leaf paths, parent symlink traversal was not fully canonicalized before allowed-root and blocked-path checks.

Security Impact

A source path that looked inside an allowed root could resolve outside that root (including blocked runtime paths) once the missing leaf was created, weakening sandbox bind-source boundary enforcement.

Fix

The validation path now canonicalizes through the nearest existing ancestor, then always re-checks the canonical path against both:

allowed source roots
blocked runtime paths

Verification

pnpm check
pnpm exec vitest run --config vitest.gateway.config.ts
pnpm test:fast
Added regression tests for symlink-parent + missing-leaf bypass patterns.

Fix Commit(s)

b5787e4abba0dcc6baf09051099f6773c1679ec1

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.24) so after npm publish the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

Publication Update (2026-02-25)

openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-m8v2-6wwh-r4gc

GHSA-m8v2-6wwh-r4gc:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.23	2026.2.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the sandbox's bind mount validation logic, specifically within the validateBindMounts function in src/agents/sandbox/validate-sandbox-security.ts. The root cause was the improper handling of symlinks when a bind source path pointed to a location that did not yet exist.

The analysis of the patch b5787e4abba0dcc6baf09051099f6773c1679ec1 reveals that validateBindMounts relied on a helper function, tryRealpathAbsolute, to resolve symbolic links and obtain the canonical path of a bind source. However, tryRealpathAbsolute would only perform this resolution if the entire path existed. If an attacker provided a path where a parent directory was a symlink pointing outside the allowed sandbox root, and the final component of the path (the "leaf") did not exist, tryRealpathAbsolute would silently return the original, unresolved path.

The validateBindMounts function would then incorrectly approve this path as being inside the allowed root. Later, when the sandboxed process creates the missing leaf, it would be created at the location the symlink pointed to, effectively bypassing the sandbox's path restrictions.

The fix replaces the flawed tryRealpathAbsolute with a new function, resolvePathViaExistingAncestor. This new function correctly canonicalizes the path by finding the deepest existing ancestor, resolving its real path, and then re-appending the non-existent leaf segments. This ensures that symlinks are always resolved before security checks are performed.

Therefore, the key vulnerable functions are validateBindMounts, which orchestrates the check, and the now-removed tryRealpathAbsolute, which contained the flawed logic. During exploitation, validateBindMounts would be the function observed in a runtime profile performing the incorrect validation.

Vulnerable functions

validateBindMounts

src/agents/sandbox/validate-sandbox-security.ts

This function is responsible for validating bind mounts. Before the patch, it used the `tryRealpathAbsolute` function, which failed to correctly canonicalize paths that contained a non-existent leaf component following a symlinked directory. This allowed an attacker to bypass sandbox restrictions by crafting a source path that appeared to be in an allowed directory but would resolve to a blocked or disallowed location once the leaf was created.

tryRealpathAbsolute

src/agents/sandbox/validate-sandbox-security.ts

This helper function, which was removed in the patch, contained the core flaw. It would only attempt to resolve a path's realpath if the entire path existed on the filesystem. For paths with a non-existent final component (leaf), it would return the original, un-canonicalized path, allowing symlinks in the parent path to be missed during security validation.

normalizeAllowedRoots

src/agents/sandbox/validate-sandbox-security.ts

This function was also vulnerable as it used the flawed `tryRealpathAbsolute` function to resolve the paths of allowed roots. This could lead to an incomplete and incorrect set of canonicalized allowed paths, contributing to the bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-m8v2-6wwh-r4gc: OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths

Summary

Affected Packages / Versions

Root Cause

Security Impact

Fix

Verification

Fix Commit(s)

Release Process Note

Publication Update (2026-02-25)

GHSA-m8v2-6wwh-r4gc:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-m8v2-6wwh-r4gc: OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths

Summary

Affected Packages / Versions

Root Cause

Security Impact

Fix

Verification

Fix Commit(s)

Release Process Note

Publication Update (2026-02-25)

Basic Information

Basic Information

Technical Details

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI