Which versions of OpenClaw are affected by CVE-2026-62191?

OpenClaw versions 2026.6.6 through 2026.6.8 contain a privilege escalation vulnerability (CWE-862: missing authorization check) that allows users with limited access to invoke privileged…

How to fix or mitigate CVE-2026-62191?

Within 24 hours, identify all OpenClaw 2026.6.6-2026.6.8 deployments in your environment and verify whether the message-mutation feature is enabled on each system. Within 7 days, implement interim controls: disable the message-mutation feature if operationally feasible, restrict network access to affected instances to authorized administrators only, and enable detailed audit logging of all mutation operations. Within 30 days, establish vendor contact for patch availability, prepare non-production testing procedures, and establish a monitoring process for OpenClaw security advisories to ensure rapid deployment when updates become available.

OpenClaw CVE-2026-62191

Q: What is the CVSS score of CVE-2026-62191?

CVE-2026-62191 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Missing Authorization (CWE-862)

2026-07-13 VulnCheck

Authentication Bypass Openclaw

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable mutation endpoint with low complexity and no user interaction; PR:L because a low-trust authenticated account is required; integrity high, availability low, no confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:04 vuln.today

CVE Published

Jul 13, 2026 - 21:30 cve.org

HIGH 7.1

DescriptionCVE.org

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.

AnalysisAI

Privilege escalation via authorization bypass in OpenClaw 2026.6.6 through 2026.6.8 allows a low-privileged, authenticated caller to invoke message-mutation operations that should require stronger authorization, letting them execute privileged actions. The flaw is a missing authorization check (CWE-862) on mutation input paths and requires the affected feature to be enabled and reachable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

OpenClaw's message mutation handling is the code path that processes requests to modify or act on messages. The root cause is CWE-862 (Missing Authorization): the handler performs the requested mutation without consistently re-validating the requester's authorization level for that specific privileged operation. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* scopes the affected component to the OpenClaw application itself. Because the authorization decision is bound to certain input paths, a request routed through a misconfigured or unchecked path reaches privileged logic while carrying only lower-trust credentials, so the trust boundary between low-privilege and high-privilege actions is not enforced at the mutation layer.

RemediationAI

Upgrade to OpenClaw 2026.6.9 or later, the first release outside the affected 2026.6.6-2026.6.8 range and, per the version boundary, the fixed build; consult https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hx-r36p-f68m for the authoritative patched version. If immediate upgrade is not possible, reduce exposure by disabling the affected message-mutation feature where it is not required (removing the reachable code path) and by restricting which low-trust accounts can reach the mutation endpoints, for example limiting network reachability to trusted administrators - the trade-off is that disabling or restricting the feature may break legitimate workflows that depend on message mutation. Review and correct the misconfigured input paths referenced in the advisory so requests cannot bypass requester authorization.