Is there a patch available for CVE-2026-62220?

Yes, a patch is available for CVE-2026-62220. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-62220

Q: What is the CVSS score of CVE-2026-62220?

CVE-2026-62220 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45108 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-07-17 VulnCheck

GHSA-vfpw-6fgp-w7h6

Authentication Bypass Openclaw

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AT:P in CVSS 4.0 maps to AC:H in 3.1 - the feature must be enabled and reachable by lower-trust callers; impact is availability-only and low.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:04 vuln.today

DescriptionCVE.org

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

AnalysisAI

WebSocket authentication rate limit bypass in OpenClaw versions 2026.2.25 through pre-2026.5.26 enables lower-trust callers or configured non-browser input paths to flood authentication attempts without being throttled at the gateway layer. The impact is limited to availability - an attacker can consume gateway connection and compute resources, degrading service for legitimate users. No public exploit has been identified at time of analysis and OpenClaw does not appear in the CISA KEV catalog.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is a gateway-layer product that enforces WebSocket authentication with separate rate-limiting paths for browser and non-browser clients. CWE-307 (Improper Restriction of Excessive Authentication Attempts) identifies the root cause: the non-browser rate limit enforcement path contains a logic gap that allows lower-trust callers, or callers routing through certain configured input paths, to send authentication attempts without being throttled. The CVSS 4.0 AT:P (Attack Target: Presence of a precondition) metric confirms that exploitation depends on the affected feature being active and reachable from a lower-trust network source.

RemediationAI

Upgrade OpenClaw to version 2026.5.26 or later, which resolves the WebSocket authentication rate limit bypass per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-5p6w-wmh3-frfr and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-websocket-rate-limit-bypass. If an immediate upgrade is operationally infeasible, consider disabling the non-browser WebSocket authentication feature if it is not required - note this will interrupt any non-browser WebSocket auth flows and should be validated against application dependencies before applying. Alternatively, restrict access to the WebSocket authentication endpoint at the network perimeter or API gateway layer to trusted sources only, reducing the pool of callers that could exploit the non-browser path. These compensating controls are stopgaps and do not replace patching.