Vulnerability details

CVE-2026-62191

OpenClaw OpenClaw

OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations

CVSS 4.0

7.1High

Official description

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N`
7.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
OpenClaw	OpenClaw	2026.6.6 ≤ v < 2026.6.9	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hx-r36p-f68m vendor-advisory
https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-message-mutations third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-14
Last updated: 2026-07-14
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.36%

Probability of exploitation in 30 days

30.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-862
Missing Authorization
CWE-863
Incorrect Authorization