Authorization bypass in the device-pair approval feature of OpenClaw (CVE-2026-62223)

CVE-2026-62223 is an authorization bypass vulnerability in the device-pair approval feature of OpenClaw that allows a lower-trust caller or configured input path to execute or persist actions beyond the caller's intended authorization (CWE-78: OS Command Injection). When the affected feature is enabled and reachable, practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path; the issue carries a CVSS v3.1 score of 8.8 (High). Affected versions: - <= 2026.5.12 We recommend updating to: 2026.5.18. CVSS 7.7 · our assessment: this_week Vendor advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-hx85-fgcw-9vrc Details: https://vuln.today/cve/CVE-2026-62223