CVE-2026-62214 | OpenClaw versions before 2026.5.28 Bot Framework contains an… | CVSS 6.5 MEDIUM

Description

OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary.

Metadata

CVE ID: CVE-2026-62214
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-13 16:39 UTC
Published: 2026-07-17 00:06 UTC
Last updated: 2026-07-17 00:06 UTC
Primary CWE: CWE-522
Insufficiently Protected Credentials
Vendor / Product: openclaw / msteams
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
openclaw	msteams	—	0 < 2026.5.28, 2026.5.28

Weakness (CWE)

CWE	Source	Description
CWE-522	cna	Insufficiently Protected Credentials

CVSS scores (2)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.0	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-prwc-c6w5-mmgr) https://github.com/openclaw/openclaw/security/advisories/GHSA-prwc-c6w5-mmgr
VulnCheck Advisory: OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation https://www.vulncheck.com/advisories/openclaw-bot-framework-ssrf-via-serviceurl-parameter-validation