CVE-2026-62194CWE-732CWE-862

OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install

High · published July 13, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00447 · 38.0th percentile
Weaknesses
CWE-732 · Incorrect Permission Assignment for Critical Resource; CWE-862 · Missing Authorization
Published
2026-07-13T21:30Z
EPSS history
Timeline
  • 13 JUL 21:30Z
    OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install
    cvelistv5