Untrusted Plugin Loading Vulnerability in OpenClaw by OpenClaw
CVE-2026-62222

7.1HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
17 July 2026

What is CVE-2026-62222?

OpenClaw versions prior to 2026.5.22 exhibit a security vulnerability that allows untrusted workspace plugins to be loaded through setup-mode discovery. This flaw can be exploited by attackers who possess lower-trust caller access or manage configured input paths. Consequently, these attackers can perform actions that exceed their intended authorization levels, leading to potential misuse of the system.

Affected Version(s)

OpenClaw 0 < 2026.5.22

OpenClaw 2026.5.22

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/openclaw-untrusted-p...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.