CVE-2026-62190CWE-706CWE-863broken-access-control

CVE-2026-62190

High · published July 14, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.5th percentile
Weaknesses
CWE-706 · Use of Incorrectly-Resolved Name or Reference; CWE-863 · Incorrect Authorization
Published
2026-07-14T02:16Z
Affected products (1)
ProductVersionsFixed in
openclaw/openclaw< 2026.6.92026.6.9
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-3fp5-v549-9v66 · [email protected]https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-flock-wrapper · [email protected]
EPSS history
Timeline
  • 13 JUL 21:30Z
    OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper
    cvelistv5