CVE-2026-62195CWE-732

OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback

High · published July 13, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00396 · 32.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-07-13T21:30Z
EPSS history
Timeline
  • 13 JUL 21:30Z
    OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback
    cvelistv5