Which versions of Openclaw are affected by EUVD-2026-45092?

OpenClaw versions prior to 2026.6.6 contain a high-severity privilege escalation vulnerability enabling low-privilege users to execute actions above their authorization level.. A patch is available.

How to fix or mitigate EUVD-2026-45092?

Within 24 hours, inventory all systems running OpenClaw versions prior to 2026.6.6 and immediately restrict process execution permissions to administrative accounts only. Within 7 days, implement system-level environment variable filtering to prevent rustup and startup variable injection attacks, and establish monitoring for suspicious child process creation patterns. Within 30 days, establish a patch testing environment and maintain readiness for immediate upgrade to 2026.6.6 once available; in parallel, evaluate process sandboxing and containerization as long-term architectural mitigations.

Openclaw EUVD-2026-45092

Q: What is the CVSS score of EUVD-2026-45092?

EUVD-2026-45092 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

| CVE-2026-62203 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-07-17 VulnCheck

GHSA-q58p-x48c-c32c

Information Disclosure Openclaw

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:00 vuln.today

CVE Published

Jul 17, 2026 - 00:06 cve.org

HIGH 7.7

DescriptionCVE.org

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.

AnalysisAI

Privilege escalation and unauthorized action execution in OpenClaw before 2026.6.6 arises from incomplete environment-variable filtering in its host exec path, which fails to strip rustup startup variables before spawning processes. A low-privilege caller (PR:L) with access to lower-trust invocation paths or configured input paths can influence the child process environment to run or persist actions above their intended authorization level, yielding high confidentiality, integrity, and availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all systems running OpenClaw versions prior to 2026.6.6 and immediately restrict process execution permissions to administrative accounts only. …

Threat intelligence, references, and detailed analysis are available after sign-in.