Which versions of OpenClaw are affected by CVE-2026-62218?

OpenClaw versions 2026.1.20 through 2026.5.26 contain an authorization bypass in device pairing approval functionality that permits low-privilege authenticated users to escalate their effective…. A patch is available.

How to fix or mitigate CVE-2026-62218?

Within 24 hours, inventory all OpenClaw deployments to identify instances running versions 2026.1.20 through 2026.5.26. Within 7 days, implement compensating controls: restrict direct access to the device.pair.approve endpoint to administrative accounts, enable detailed audit logging for all device pairing activities, and manually review approval logs for unauthorized patterns. Within 30 days, monitor OpenClaw vendor advisories for patch release and prepare an emergency patching schedule; evaluate alternative solutions or version upgrades to unaffected releases if available.

OpenClaw CVE-2026-62218

Q: What is the CVSS score of CVE-2026-62218?

CVE-2026-62218 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45106 HIGH

Missing Authorization (CWE-862)

2026-07-17 VulnCheck

GHSA-4cxx-m26f-jmx8

Authentication Bypass Openclaw

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity authorization bypass needing an authenticated low-trust account (PR:L) and no user interaction, with high confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:57 vuln.today

CVE Published

Jul 17, 2026 - 00:06 cve.org

HIGH 8.7

DescriptionCVE.org

OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.

AnalysisAI

Authorization bypass in OpenClaw versions 2026.1.20 through 2026.5.26 allows low-trust, authenticated callers to invoke the device.pair.approve feature and perform device-pairing approvals that should require stronger role-management authorization. Because the feature can be reached through configured input paths, an attacker holding only limited privileges can escalate their effective authority over device pairing, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 8.7.

Technical ContextAI

OpenClaw exposes a device pairing/approval workflow via a device.pair.approve action that is expected to enforce role-management (authorization) checks before granting approval. The root cause is CWE-862 (Missing Authorization): the code path that services device.pair.approve fails to consistently verify that the caller holds the required trust level, so authorization is either omitted or applied only at a layer that lower-trust callers can bypass by reaching the feature through configured input paths. The single CPE, cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, indicates the affected component is the OpenClaw application itself rather than a bundled third-party library, so the fix is an application-level authorization enforcement change delivered in 2026.5.27.

RemediationAI

Upgrade to the fixed release: Vendor-released patch: OpenClaw 2026.5.27, which restores the role-management authorization checks on the device.pair.approve feature; consult the GitHub Security Advisory GHSA-8v95-qqcm-qp9h (https://github.com/openclaw/openclaw/security/advisories/GHSA-8v95-qqcm-qp9h) for exact upgrade guidance. If immediate patching is not possible, reduce exposure by restricting who can reach the device.pair.approve feature and the configured input paths that expose it - for example, limit device-pairing approval endpoints to trusted administrative networks or accounts and tighten the role assignments granted to lower-trust callers so fewer principals can invoke the action, accepting that this may block legitimate self-service pairing workflows. Monitor pairing-approval activity for approvals initiated by accounts that should not hold that authority until the upgrade is applied, and review the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-device-pair-approve) for any additional mitigations.