CVE-2026-62186CWE-862CWE-863broken-access-control

CVE-2026-62186

High · published July 14, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.8th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-07-14T02:16Z
Affected products (1)
ProductVersionsFixed in
openclaw/openclaw< 2026.6.82026.6.8
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-jhfx-v2j8-x3m6 · [email protected]https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-http-model-override · [email protected]
EPSS history
Timeline
  • 13 JUL 21:30Z
    OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override
    cvelistv5