Authorization Bypass in OpenClaw Product by OpenClaw
CVE-2026-62195

8.7HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
13 July 2026

What is CVE-2026-62195?

OpenClaw versions 2026.5.20 and earlier than 2026.6.6 are susceptible to an authorization bypass vulnerability due to inadequacies in the MCP loopback feature. This vulnerability permits lower-trust callers to access and execute owner-specific tools, circumventing established authorization check protocols. Attackers could exploit configured input paths to carry out actions or maintain persisted states that exceed their assigned permissions, posing serious risks to the integrity and security of the application's functions.

Affected Version(s)

OpenClaw 2026.5.20 < 2026.6.6

OpenClaw 2026.6.6

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/openclaw-authorizati...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Edward-x (@YLChen-007)
.