CVE-2026-32043: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32043 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.2.25. In the approval-bound system.run execution flow, the cwd (current working directory) parameter is validated at approval time but resolved at execution time, creating a window during which an attacker can retarget a symlinked cwd to bypass command execution restrictions and run arbitrary commands on node hosts. It carries a CVSS v3.1 base score of 7.0 (High) and a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition) and CWE-59 (Improper Link Resolution Before File Access / Link Following). OpenClaw's gateway validates the cwd parameter — including command, argv, and binding fields — as plain text at approval time, but the node host resolves the actual filesystem path at execution time via spawn. An attacker with low privileges who can create or modify symlinks can retarget a symlinked cwd directory between the approval and execution phases, causing the spawned process to execute in an unintended directory context and effectively bypass operator-reviewed command execution restrictions. The attack requires local access and precise timing (high attack complexity), but no user interaction is needed (GitHub Advisory, Patch Commit).

Successful exploitation allows a low-privileged local attacker to execute arbitrary commands on node hosts by bypassing the approval-based command execution security boundary. This can result in high integrity and availability impacts — including unauthorized code execution, data manipulation, and potential system compromise — as well as a limited confidentiality impact. While the scope is unchanged (no cross-privilege-boundary escalation is guaranteed), the ability to run arbitrary commands in an attacker-controlled working directory context can facilitate further lateral movement or persistence within the affected host (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.008% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and precise timing to win the race condition between approval and execution, which raises the practical bar for attackers (Feedly).

1. Gain local access: Obtain a low-privileged account on a system running OpenClaw (npm) version ≤ 2026.2.24 with system.run approval workflows enabled.
2. Create a benign symlinked cwd: Create a symlink (e.g., ln -s /safe/approved/dir /tmp/cwd-link) pointing to a directory that will pass the approval-time validation check for the cwd parameter.
3. Submit an approval request: Trigger an approval-bound system.run request using the symlinked path (/tmp/cwd-link) as the cwd parameter. The gateway validates the command, argv, and cwd as text at this stage.
4. Race the symlink retarget: Immediately after approval is granted but before the node host resolves and spawns the process, atomically retarget the symlink to a different directory (e.g., ln -sfn /attacker/controlled/dir /tmp/cwd-link) containing a malicious script or executable.
5. Achieve arbitrary command execution: The node host resolves the cwd symlink at execution time, now pointing to the attacker-controlled directory, and spawns the approved command in that context — executing attacker-supplied code while bypassing the approval restriction (GitHub Advisory, Patch Commit).

• File System: Presence of symlinks in directories used as cwd for OpenClaw system.run executions; rapid creation or modification of symlinks (via lstat showing isSymbolicLink() true) in temporary or working directories associated with OpenClaw node hosts.
• Process: Unexpected processes spawned by the OpenClaw node host process from unusual working directories not matching approved paths; child processes executing scripts from attacker-controlled directories.
• Logs: OpenClaw execution logs showing cwd paths that differ between the approval request and the actual spawn working directory; error messages containing SYSTEM_RUN_DENIED: approval requires canonical cwd on patched systems (indicating attempted exploitation).
• Network: Outbound connections from the OpenClaw node host process to unexpected external addresses following a system.run approval event (GitHub Advisory, Patch Commit).

Upgrade OpenClaw (npm) to version 2026.2.25 or later, which introduces defense-in-depth hardening: symlinked cwd paths are now rejected for approval-bound system.run execution, path-like executable argv tokens are canonicalized via fs.realpathSync before spawn, and CLI approval requests are bound to exact commandArgv identity (GitHub Advisory, Patch Commit). As a configuration-based workaround prior to patching, restrict filesystem permissions to prevent low-privileged users from creating or modifying symlinks in directories used as cwd for OpenClaw operations, and monitor for suspicious symlink activity. Review approval workflows to ensure validation occurs at execution time for all filesystem-dependent parameters (Feedly).

The vulnerability was reported by security researcher @tdjackey and disclosed by OpenClaw maintainer steipete via a GitHub Security Advisory published February 26, 2026. The advisory was assigned a "Moderate" severity by the OpenClaw project, reflecting the local access requirement and high attack complexity. No significant broader media coverage or notable community commentary beyond the official advisory has been observed (GitHub Advisory).