CVE-2026-62214

OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation

State: Published
Severity: 6.0 Medium
Published: Jul 17, 2026
Updated: Oct 8, 2026
Reserved: Jul 13, 2026

Description

OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
msteamsopenclaw	before 2026.5.28Affected 2026.5.28Not affected

References

GitHub Security Advisory (GHSA-prwc-c6w5-mmgr)vendor-advisory
VulnCheck Advisory: OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.