CVE-2026-62229CWE-22

OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching

High · published July 17, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the allowlist glob patterns to execute or persist unauthorized actions when the affected feature is enabled.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00716 · 53.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-17T00:07Z
EPSS history
Timeline
  • 17 JUL 00:07Z
    OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching
    cvelistv5