CVE-2026-62229 | OpenClaw before 2026.5.18 contain an authorization bypass vu… | CVSS 8.8 HIGH

Description

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the allowlist glob patterns to execute or persist unauthorized actions when the affected feature is enabled.

Metadata

CVE ID: CVE-2026-62229
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-13 16:40 UTC
Published: 2026-07-17 00:07 UTC
Last updated: 2026-07-17 00:07 UTC
Primary CWE: CWE-22
Improper Limitation of a Pathname to a Restricted Directory …
Vendor / Product: OpenClaw / OpenClaw
Sources: cve.org · NVD

Severity & Metrics

8.8 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
OpenClaw	OpenClaw	—	0 < 2026.5.18, 2026.5.18

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.8	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-34mr-7r3m-gfg7) https://github.com/openclaw/openclaw/security/advisories/GHSA-34mr-7r3m-gfg7
VulnCheck Advisory: OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-glob-matching