Is there a patch available for CVE-2026-62221?

Yes, a patch is available for CVE-2026-62221. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-62221

Q: What is the CVSS score of CVE-2026-62221?

CVE-2026-62221 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-45109 LOW

Incorrect Authorization (CWE-863)

2026-07-17 VulnCheck

GHSA-g2wq-2v6h-rhvf

Authentication Bypass Openclaw

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

AT:P from CVSS 4.0 maps to AC:H; low privileges required; no scope change; limited confidentiality and integrity impact only.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:04 vuln.today

DescriptionCVE.org

OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, including running non-allowlisted commands.

AnalysisAI

Incorrect authorization in OpenClaw's ClickClack allowFrom feature permits a lower-trust, authenticated caller to exceed their intended permission boundary - executing or persisting non-allowlisted commands - on versions 2026.5.12 through before 2026.5.26. The flaw (CWE-863) is contingent on the ClickClack allowFrom feature being both enabled and reachable, which meaningfully limits the exploitable population. No public exploit exists and the vulnerability is not listed in CISA KEV; a CVSS 4.0 score of 2.3 reflects the constrained attack surface.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements a feature called ClickClack with an allowFrom sub-mechanism intended to restrict which callers or input paths may trigger specific actions. CWE-863 (Incorrect Authorization) describes a class of flaws where the authorization logic is present but misconfigured or improperly implemented - the product does perform a check, but the check fails to correctly enforce the intended boundary, effectively granting callers access to actions or commands they should be denied. In this case, the allowFrom allowlist is bypassable by a lower-trust caller, allowing execution or persistence of commands not on the approved list. The CVSS 4.0 AT:P (Attack Requirements: Present) metric confirms that specific deployment conditions - namely the allowFrom feature being active and network-reachable - must hold for the flaw to be exploitable.

RemediationAI

Upgrade to OpenClaw 2026.5.26 or later, which contains the vendor-released fix as described in the GitHub security advisory GHSA-fh8v-vgcv-pwh4 (https://github.com/openclaw/openclaw/security/advisories/GHSA-fh8v-vgcv-pwh4). If immediate patching is not feasible, disable the ClickClack allowFrom feature entirely until the upgrade can be applied; this eliminates the vulnerable code path but may disable associated functionality that depends on caller-based allowlisting. Alternatively, restrict network reachability of the allowFrom endpoint to only fully trusted callers via network-layer controls (firewall rules, ingress filtering), reducing the likelihood that a lower-trust caller can reach the feature. Either compensating control removes the AT:P condition that enables exploitation.