CVE-2026-62228
HIGH
CVSS 7.7
openclaw
Verified Advisory
Authorization bypass in OpenClaw node exec approvals (CVE-2026-62228)
CVE-2026-62228 is an authorization bypass vulnerability (CWE-863, CVSS 8.8 High) in OpenClaw's node exec approvals feature. A lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization by using mismatched gateway and node environments. When the affected feature is enabled and reachable, the impact to confidentiality, integrity, and availability is rated High.
Affected versions:
- < 2026.6.5
We recommend updating to: 2026.6.5.
CVSS 7.7 · our assessment: this_week
Vendor advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-8f46-3xx3-8c9m
Details: https://vuln.today/cve/CVE-2026-62228
Verified by vuln.today against published advisories.
Affected versions
- – < 2026.6.5
Fixed in: 2026.6.5
More advisories for openclaw
- CVE-2026-62202 – Privilege escalation in OpenClaw cron jobs (CVE-2026-62202)
- CVE-2026-62203 – Environment variable injection in OpenClaw host exec (CVE-2026-62203)
- CVE-2026-62207 – Authentication bypass in OpenClaw (CVE-2026-62207)
- CVE-2026-62209 – Authorization bypass in OpenClaw ClickClack agent-mode dispatch (CVE-2026-62209)
- CVE-2026-62217 – Authorization bypass in OpenClaw QQBot exec approvals (CVE-2026-62217)
- CVE-2026-62222 – Privilege escalation in OpenClaw via untrusted workspace plugin loading (CVE-2026-62222)
- CVE-2026-62218 – Authorization bypass in OpenClaw's device (CVE-2026-62218)
- CVE-2026-62223 – Authorization bypass in the device-pair approval feature of OpenClaw (CVE-2026-62223)