OpenClaw CVE-2026-62194

Exploitation requires an authenticated low-trust caller (PR:L) with reachability to the OpenClaw plugin install command on a version between 2026.5.20 and 2026.6.8. The specific enabling conditions named in the CVE are a 'misconfigured input path' or an 'enabled feature' that makes the plugin-install code path reachable to the lower-trust caller - so exploitation depends on that feature being enabled/exposed rather than on a fully default configuration. Limiting factors: the attacker must already hold valid low-level credentials, the plugin-install feature must be reachable from that privilege level, and an affected version must be deployed; instances that restrict plugin installation to administrators, disable the relevant feature, or run a single trusted operator are not practically exploitable. No user interaction is required (UI:N).

The vendor CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - network-reachable, low complexity, no attack requirements, only low privileges and no user interaction, yielding full high impact on the vulnerable system but no subsequent-system (scope) impact. That is a genuine escalation concern wherever lower-trust users can authenticate. However, several priority signals are absent: no EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so there is no evidence of active or automatable exploitation. Realistic risk therefore hinges on whether the plugin-install feature is exposed and whether a deployment actually grants plugin-adjacent access to low-trust users; in default or single-operator installs the practical risk is lower than 8.7 suggests. The description's hedging ('when the feature is reachable', 'misconfigured input paths or enabled features') tempers the PR:L/AV:N reading - exploitation appears configuration-dependent, which the base vector does not fully capture. EPSS and POC status are UNKNOWN and should be confirmed before final prioritization.

A low-privilege but authenticated OpenClaw user targets the plugin install command, supplying a crafted input path or leveraging an enabled feature reachable from their trust level. Because permissions on the install path are incorrectly assigned, the action executes with authority beyond the caller's intended scope, letting them run or persist actions that compromise the instance. No public POC is referenced, but low attack complexity (AC:L) and no required user interaction make exploitation straightforward once the feature is reachable.