OpenClaw CVE-2026-62198

Q: What is the CVSS score of CVE-2026-62198?

CVE-2026-62198 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Incorrect Authorization (CWE-863)

2026-07-13 VulnCheck

Authentication Bypass Openclaw

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network exploitable requiring low privilege (PR:L); 'execute restricted operations' phrase indicates at least low integrity impact, diverging from vendor's VI:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:13 vuln.today

DescriptionCVE.org

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured input paths to bypass intended authorization controls and execute restricted operations.

AnalysisAI

Authorization bypass in OpenClaw's native web search component allows authenticated lower-trust callers to invoke operations normally gated behind stronger policy checks. Versions 2026.5.28 through 2026.6.5 are affected, with exploitation requiring crafted input paths targeting misconfigured authorization logic - no special tooling needed given the low attack complexity. No public exploit code or CISA KEV listing exists at time of analysis, but the network-reachable attack surface and low complexity reduce the barrier for abuse by compromised or malicious low-privilege accounts.

Technical ContextAI

OpenClaw (cpe:2.3:a:openclaw:openclaw) implements a native web search subsystem that enforces tiered authorization policies distinguishing caller trust levels. CWE-863 (Incorrect Authorization) identifies the root cause: the authorization logic fails to correctly validate whether a caller's trust level satisfies policy requirements for a requested operation when input paths are in a misconfigured state. The vulnerability exists at the boundary between lower-trust and higher-trust execution contexts in the web search interface, where malformed or unexpected input paths can bypass the intended policy gate without triggering the appropriate trust-level enforcement.

RemediationAI

Upgrade OpenClaw to version 2026.6.6 or later, which resolves the authorization bypass per the vendor's GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-v4f6-x5g5-2g4g. If immediate patching is not feasible, restrict access to the native web search feature to fully trusted callers only through network-layer access controls or application-level configuration; disabling the web search feature entirely is an effective compensating control but will break any dependent functionality. Auditing which lower-trust accounts have access to the web search endpoint and revoking unnecessary access reduces the attack surface while patching is arranged.