CVE-2026-62209CWE-863

OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch

High · published July 17, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00370 · 29.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-17T00:06Z
EPSS history
Timeline
  • 17 JUL 00:06Z
    OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch
    cvelistv5