Vulnerabilities

TI-2026-44451 CVE-2026-62228 · GHSA-xjjc-hxq8-fxj5

OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals

LOW 36

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node env…

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00451 Published 2026-07-17 Fixed in 2026.6.5 CWE-863

TI-2026-44438 CVE-2026-62215 · GHSA-2x3r-854j-qm5f

OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas

LOW 25

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0025 Published 2026-07-17 Fixed in 2026.6.5 CWE-345

TI-2026-44432 CVE-2026-62209 · GHSA-8x5v-5gh2-qr2j

OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch

LOW 35

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.0037 Published 2026-07-17 Fixed in 2026.6.5 CWE-863

TI-2026-44431 CVE-2026-62208 · GHSA-pwc7-4jwg-rqg5

OpenClaw < 2026.6.5 Authorization Header Forwarding via SSE

LOW 27

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00358 Published 2026-07-17 Fixed in 2026.6.5 CWE-522

TI-2026-44430 CVE-2026-62207 · GHSA-86p5-rr4v-4pj8

OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools