CVE-2026-62191
OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 13, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jul 13, 2026
Description
OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-v7hx-r36p-f68m)vendor-advisory
- VulnCheck Advisory: OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutationsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.