OpenClaw CVE-2026-62222

Exploitation requires that OpenClaw's setup-mode discovery run against plugin/workspace input paths the attacker can influence, plus one of two footholds named in the advisory: 'lower-trust caller access' to the setup process, or 'control over configured input paths' where a malicious workspace plugin can be placed. Limiting factors from the CVSS 4.0 vector: the vector is local (AV:L), a specific attack precondition must be satisfied (AT:P), and a legitimate user must actively perform the triggering interaction (UI:A) - it cannot be driven remotely or fully unattended. This is therefore not remote unauthenticated exploitation against default configurations; it depends on the attacker's ability to control plugin sources and on setup mode being invoked.

The signals point to a real but access-gated issue rather than a mass-exploitable one. The CVSS 4.0 vector is AV:L (local, not network), AC:L, AT:P (a particular attack precondition must hold), PR:N, UI:A (active victim interaction required), with high confidentiality, integrity and availability impact to the vulnerable system (VC/VI/VA:H) and no subsequent-system impact (SC/SI/SA:N), yielding a base score of 7.1 (High). The description's own language - 'lower-trust caller access or control over configured input paths' - corroborates that some foothold or configuration influence is a prerequisite, consistent with AV:L and AT:P and slightly at odds with the PR:N metric, so the practical privilege requirement should be treated as 'some access likely needed' pending vendor clarification. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or automatable mass abuse; the 'Information Disclosure' tag understates the impact given the CVSS integrity/availability highs, which reflect code/action execution. Net: prioritize where OpenClaw processes attacker-influenceable workspace/config paths, but this is not an internet-facing wormable bug.

An attacker who can write to a directory referenced by OpenClaw's configured plugin input paths (or who acts as a lower-trust caller into setup mode) plants a malicious workspace plugin. When a user triggers setup-mode discovery, OpenClaw loads the untrusted plugin and executes its logic with the application's authorization level, letting the attacker persist actions beyond their intended privileges. No public exploit code is identified, and the attack requires the local access, the specific precondition (AT:P), and the victim's active interaction (UI:A) reflected in the CVSS vector.