CVE-2026-62217
HIGH
CVSS 7.7
openclaw
Verified Advisory
Authorization bypass in OpenClaw QQBot exec approvals (CVE-2026-62217)
CVE-2026-62217 is an authorization flaw in OpenClaw's QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond their intended authorization, allowing non-allowlisted senders to perform unauthorized operations. The vulnerability is rated High severity (CVSS 8.8).
Affected versions:
- >= 2026.5.14-beta.1, < 2026.5.27
We recommend updating to: 2026.5.27.
CVSS 7.7 · our assessment: this_week
Vendor advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-7jx6-764p-fgg9
Details: https://vuln.today/cve/CVE-2026-62217
Verified by vuln.today against published advisories.
Affected versions
- – >= 2026.5.14-beta.1, < 2026.5.27
Fixed in: 2026.5.27
More advisories for openclaw
- CVE-2026-62202 – Privilege escalation in OpenClaw cron jobs (CVE-2026-62202)
- CVE-2026-62203 – Environment variable injection in OpenClaw host exec (CVE-2026-62203)
- CVE-2026-62207 – Authentication bypass in OpenClaw (CVE-2026-62207)
- CVE-2026-62209 – Authorization bypass in OpenClaw ClickClack agent-mode dispatch (CVE-2026-62209)
- CVE-2026-62222 – Privilege escalation in OpenClaw via untrusted workspace plugin loading (CVE-2026-62222)
- CVE-2026-62218 – Authorization bypass in OpenClaw's device (CVE-2026-62218)
- CVE-2026-62223 – Authorization bypass in the device-pair approval feature of OpenClaw (CVE-2026-62223)
- CVE-2026-62229 – Authorization bypass in OpenClaw exec allowlist glob matching (CVE-2026-62229)