Which versions of OpenClaw are affected by CVE-2026-62217?

OpenClaw's QQBot exec approvals feature in versions 2026.5.14-beta.1 through 2026.5.26 contains a privilege escalation vulnerability enabling non-authorized users to bypass approval controls and…. A patch is available.

How to fix or mitigate CVE-2026-62217?

Within 24 hours, audit your OpenClaw environment to determine whether QQBot exec approvals is enabled and identify your current version against the affected range (2026.5.14-beta.1 through 2026.5.26). Within 7 days, upgrade all affected OpenClaw installations to version 2026.5.27 or later to remediate the authorization bypass vulnerability. Within 30 days, conduct a retrospective security review of all build approvals and command executions during the vulnerable exposure period to detect any unauthorized actions, and validate that approval controls function correctly following the upgrade.

OpenClaw CVE-2026-62217

Q: What is the CVSS score of CVE-2026-62217?

CVE-2026-62217 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45105 HIGH

Incorrect Authorization (CWE-863)

2026-07-17 VulnCheck

GHSA-rv8f-q23g-2wjx

Authentication Bypass Openclaw

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable but gated by the exec approvals feature being enabled (AC:H) and requiring a low-trust foothold (PR:L); full high impact confined to the vulnerable system, no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:57 vuln.today

CVE Published

Jul 17, 2026 - 00:06 cve.org

HIGH 7.7

DescriptionCVE.org

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

AnalysisAI

Privilege escalation via authorization bypass in OpenClaw's QQBot exec approvals feature affects builds from 2026.5.14-beta.1 up to (but not including) 2026.5.27, letting a lower-trust or non-allowlisted sender execute or persist actions beyond their intended authorization. The CVSS 4.0 vector requires low existing privileges (PR:L) and a present attack requirement (AT:P), meaning the exec approvals feature must be enabled and reachable for exploitation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a fixed release (2026.5.27) and a vendor security advisory are available.

Technical ContextAI

OpenClaw is an open-source automation/bot platform whose QQBot integration exposes an 'exec approvals' feature that gates who may trigger the execution or persistence of privileged actions, typically enforced through a sender allowlist. The root cause is classified as CWE-863 (Incorrect Authorization): the approval/allowlist check is applied incorrectly or incompletely, so the trust decision does not match the caller's actual privilege. Rather than a missing authentication layer, this is a flawed authorization decision - a validly-connected but lower-trust caller (or a configured input path) is treated as authorized for operations it should be denied. The single wildcard CPE (cpe:2.3:a:openclaw:openclaw:*) indicates the flaw is in the core application rather than a specific optional module packaged separately.

RemediationAI

Upgrade to the fixed release - Vendor-released patch: 2026.5.27 - which is the primary and recommended fix; consult GitHub Security Advisory GHSA-7jx6-764p-fgg9 (https://github.com/openclaw/openclaw/security/advisories/GHSA-7jx6-764p-fgg9) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-beta-1-authentication-bypass-via-exec-approvals) for exact upgrade guidance. If immediate patching is not possible, disable the QQBot exec approvals feature or make it unreachable from lower-trust callers, since AT:P confirms the feature must be enabled and reachable to exploit - the trade-off is loss of any legitimate exec-approval automation via QQBot. As additional compensating controls, tighten the sender allowlist and restrict network access to the QQBot exec endpoint to trusted callers only, and audit logs for exec/persist actions from unexpected senders; these controls reduce exposure but do not fully close the authorization flaw, so they are stopgaps until 2026.5.27 is deployed.