CVE-2026-62202
HIGH
CVSS 7.7
openclaw
Verified Advisory
Privilege escalation in OpenClaw cron jobs (CVE-2026-62202)
OpenClaw contains a privilege escalation vulnerability in isolated cron jobs whereby a lower-trust caller or misconfigured input path can execute or persist actions beyond the caller's intended authorization. The vulnerability is classified as High severity (CVSS 8.8) and involves missing or incorrect authorization checks (CWE-862, CWE-863) in the affected cron feature.
Affected versions:
- >= 2026.6.1, < 2026.6.9
We recommend updating to: 2026.6.9.
CVSS 7.7 · our assessment: this_week
Vendor advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-mm9g-83wh-mhwj
Details: https://vuln.today/cve/CVE-2026-62202
Verified by vuln.today against published advisories.
Affected versions
- – >= 2026.6.1, < 2026.6.9
Fixed in: 2026.6.9
More advisories for openclaw
- CVE-2026-62203 – Environment variable injection in OpenClaw host exec (CVE-2026-62203)
- CVE-2026-62207 – Authentication bypass in OpenClaw (CVE-2026-62207)
- CVE-2026-62209 – Authorization bypass in OpenClaw ClickClack agent-mode dispatch (CVE-2026-62209)
- CVE-2026-62217 – Authorization bypass in OpenClaw QQBot exec approvals (CVE-2026-62217)
- CVE-2026-62222 – Privilege escalation in OpenClaw via untrusted workspace plugin loading (CVE-2026-62222)
- CVE-2026-62218 – Authorization bypass in OpenClaw's device (CVE-2026-62218)
- CVE-2026-62223 – Authorization bypass in the device-pair approval feature of OpenClaw (CVE-2026-62223)
- CVE-2026-62229 – Authorization bypass in OpenClaw exec allowlist glob matching (CVE-2026-62229)