CVE-2026-62215CWE-345

OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas

Medium · published July 17, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-07-17T00:06Z
EPSS history
Timeline
  • 17 JUL 00:06Z
    OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas
    cvelistv5