CVE-2026-62189 — OpenClaw < 2026.6.9 Symlink Following via Mirror Sync
OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger auth…
Published: 2026-07-13 · CVSS: 7.6 · CVSS 4.0
OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7