Back to overview

CVE-2026-62190

HIGH
8.8
CVSS 3.1
Description
OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

Metadata

CVE ID
CVE-2026-62190
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-13 16:36 UTC
Published
2026-07-13 21:30 UTC
Last updated
2026-07-13 21:30 UTC
Primary CWE
CWE-706
Use of Incorrectly-Resolved Name or Reference
Vendor / Product
OpenClaw / OpenClaw
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
OpenClaw OpenClaw — 0 < 2026.6.9, 2026.6.9
Weakness (CWE)
CWESourceDescription
CWE-706 cna Use of Incorrectly-Resolved Name or Reference
CWE-863 cna Incorrect Authorization
CVSS scores (2)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (2)
Back to overview