Which versions of OpenClaw are affected by CVE-2026-62195?

OpenClaw versions 2026.5.20 through 2026.6.5 contain an authorization bypass that allows low-privilege users to perform owner-level functions, including data manipulation and system persistence.

How to fix or mitigate CVE-2026-62195?

Within 24 hours, inventory all OpenClaw deployments to identify which systems are running versions 2026.5.20 through 2026.6.5 and assess which of those contain sensitive data or support critical operations. Over the next 7 days, implement network segmentation to restrict access to the MCP loopback feature to trusted sources only, disable MCP loopback functionality where operationally feasible, and enforce tighter access controls to limit low-privilege users to minimum necessary permissions. Within 30 days, establish monitoring and alerting for unauthorized privilege escalation attempts, monitor vendor security advisories for patch availability, and develop an upgrade strategy to versions after 2026.6.5 once patched releases are confirmed.

OpenClaw CVE-2026-62195

Q: What is the CVSS score of CVE-2026-62195?

CVE-2026-62195 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-13 VulnCheck

Authentication Bypass Openclaw

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable, low-complexity authorization bypass by an already-authenticated low-trust caller (PR:L), yielding high confidentiality/integrity and minor availability impact with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:06 vuln.today

CVE Published

Jul 13, 2026 - 21:30 cve.org

HIGH 8.7

DescriptionCVE.org

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.

AnalysisAI

Authorization bypass in OpenClaw 2026.5.20 through 2026.6.5 lets a low-privilege caller invoke owner-only tools through the MCP loopback feature, escalating beyond intended permissions to execute or persist privileged actions. The flaw stems from incorrect permission enforcement (CWE-732) on configured input paths reachable over the network. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

OpenClaw exposes a Model Context Protocol (MCP) loopback interface intended to let trusted local components invoke tools. The vulnerability is a CWE-732 (Incorrect Permission Assignment for a Critical Resource) issue: the loopback path fails to re-validate the trust level of the caller before dispatching tools that are gated to the owner/operator role. Because certain configured input paths route requests into the loopback handler, a lower-trust actor's request is treated as if it originated from a trusted context, so owner-only tool authorization checks are effectively skipped. The single affected component is the OpenClaw application itself (cpe:2.3:a:openclaw:openclaw:*), with no dependent library implicated by the available data.

RemediationAI

Vendor-released patch: 2026.6.6 - upgrade OpenClaw to 2026.6.6 or later, which contains the fixed authorization enforcement per GHSA-52xj-c9p8-78cv (https://github.com/openclaw/openclaw/security/advisories/GHSA-52xj-c9p8-78cv). If immediate upgrade is not possible, reduce exposure by restricting network reachability of the MCP loopback interface to trusted local processes only (for example bind it to localhost/a Unix socket and firewall any TCP exposure), and audit or disable the configured input paths that route external requests into the loopback handler; the trade-off is that legitimate integrations relying on those input paths will break until reconfigured. Tighten account provisioning so low-trust callers cannot obtain the PR:L foothold the attack requires, and review logs for unexpected invocation of owner-only tools. Corroborating detail is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-mcp-loopback.