Is there a patch available for CVE-2026-62208?

Yes, a patch is available for CVE-2026-62208. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-62208

Q: What is the CVSS score of CVE-2026-62208?

CVE-2026-62208 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45096 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-07-17 VulnCheck

GHSA-pwc7-4jwg-rqg5

Information Disclosure Openclaw

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Feature must be operator-enabled and reachable by lower-trust input (AC:H); authenticated low-privilege access required (PR:L); only credential confidentiality is impacted with no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Source Code Evidence Fetched

Jul 17, 2026 - 01:08 vuln.today

Analysis Generated

Jul 17, 2026 - 01:08 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.6.5.

DescriptionCVE.org

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

AnalysisAI

Authorization header leakage in OpenClaw before 2026.6.5 exposes credentials to unintended servers during MCP SSE redirect handling, allowing an authenticated lower-trust caller to gain access to resources beyond their intended authorization scope. The vulnerability affects deployments where the MCP SSE redirect feature is enabled and reachable by lower-trust input paths, with practical impact varying by operator configuration. Vendor-released patch 2026.6.5 is available; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

OpenClaw is an npm package implementing an MCP (Model Context Protocol) Gateway, which facilitates communication between AI agents and tools using SSE (Server-Sent Events) for streaming connections. The vulnerability stems from CWE-522 (Insufficiently Protected Credentials): when the Gateway processes an SSE redirect, it improperly forwards the Authorization header - which typically carries Bearer tokens or API keys - to the redirect destination. Per RFC 9110 best practices, Authorization headers should be stripped on redirects to prevent credential leakage to unintended hosts. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all versions prior to 2026.6.5. The flaw is explicitly scoped to the MCP SSE redirect feature and does not affect OpenClaw's trusted-operator model for Gateway operators and installed plugins when no separate trust boundary is crossed.

RemediationAI

Vendor-released patch: 2026.6.5 - upgrade OpenClaw to this version or later as the primary remediation, per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-9c3v-684m-579c. Prior to upgrading, restrict the MCP SSE redirect feature to trusted operators only or disable it entirely if not operationally required, eliminating the attack surface without an immediate upgrade; note that disabling the feature will break AI agent workflows that rely on SSE-based redirects for tool connectivity. Additional hardening recommended by the vendor includes keeping channel and tool allowlists narrow and avoiding sharing a single Gateway instance among mutually untrusted users, as multi-tenant Gateway deployments are the configuration most susceptible to exploitation.