CVE-2026-62228CWE-863broken-access-control

CVE-2026-62228

High · published July 17, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to persist or execute actions that exceed the caller's approved permissions.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-17T06:18Z
Affected products (1)
ProductVersionsFixed in
openclaw/openclaw< 2026.6.52026.6.5
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-8f46-3xx3-8c9m · [email protected]https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-node-exec-approvals · [email protected]
EPSS history
Timeline
  • 17 JUL 00:07Z
    OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals
    cvelistv5