CVE-2026-62222CWE-829

OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

High · published July 17, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00176 · 6.7th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-07-17T00:07Z
EPSS history
Timeline
  • 17 JUL 00:07Z
    OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode
    cvelistv5