Which versions of OpenClaw are affected by CVE-2026-62199?

OpenClaw versions prior to 2026.6.6 contain a CVSS 8.7 authorization bypass in the host exec feature where low-privileged users can inject environment variables to execute actions beyond their…

How to fix or mitigate CVE-2026-62199?

Within 24 hours, identify all OpenClaw deployments running versions prior to 2026.6.6 and inventory systems where low-privileged users have host exec access. Within 7 days, restrict low-privileged user access to host exec where possible, deploy monitoring for environment variable injection attempts, and escalate systems where access restriction is not feasible. Within 30 days, upgrade all affected OpenClaw instances to version 2026.6.6.

OpenClaw CVE-2026-62199

Q: What is the CVSS score of CVE-2026-62199?

CVE-2026-62199 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-07-13 VulnCheck

Information Disclosure Openclaw

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity exec feature abusable by a low-privilege caller (PR:L) with no user interaction, yielding high C/I/A; no scope change since subsequent-system impact is none.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:07 vuln.today

CVE Published

Jul 13, 2026 - 21:30 cve.org

HIGH 8.7

DescriptionCVE.org

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.

AnalysisAI

Authorization bypass in OpenClaw before 2026.6.6 lets a low-privileged caller inject crafted interpreter startup environment variables through the host exec feature, executing or persisting actions beyond their intended authorization. The flaw stems from incomplete environment-variable filtering (CWE-184) that overlooks interpreter startup variables, and per its CVSS 4.0 vector (VC:H/VI:H/VA:H) yields high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; the issue is reported by VulnCheck and fixed in 2026.6.6.

Technical ContextAI

OpenClaw exposes a 'host exec' capability that runs external commands or interpreters, and applies an allow/deny filter over the environment passed to those child processes. The root cause is CWE-184 (Incomplete List of Disallowed Inputs): the filter enumerates variables to strip but misses interpreter startup variables - the special environment variables many language runtimes and shells consult at launch (e.g. loader/preload, path, startup-file, or option variables like LD_PRELOAD, PYTHONSTARTUP, BASH_ENV, PERL5OPT-style knobs). Because these are not on the deny list, a caller who controls even part of the environment can influence what code the spawned interpreter loads or executes before the intended command runs, turning environment control into privileged code execution. The affected component is identified only by the generic CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covering all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.6.6 or later, which corrects the environment-filter to also strip interpreter startup variables; this is the primary fix and is documented in advisory GHSA-hjr6-g723-hmfm (https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm). Where immediate patching is not possible, disable the host exec feature if it is not required, which removes the attack surface entirely at the cost of losing command-execution functionality; if the feature must stay on, restrict which callers and input paths can reach it (tighten authorization so no lower-trust caller can supply environment variables) and, at the process-launch layer, sanitize the child environment to a strict allow-list that explicitly clears known interpreter startup variables (for example LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP, BASH_ENV, PERL5OPT and similar), accepting that an overly aggressive allow-list may break legitimate integrations. See the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-environment-filtering) for reporter details.