Which versions of OpenClaw are affected by EUVD-2026-45111?

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability that allows authenticated employees to escalate privileges through device-pairing features, potentially compromising…. A patch is available.

How to fix or mitigate EUVD-2026-45111?

Within 24 hours, identify all OpenClaw deployments in production and restrict device-pairing approval features to administrative accounts only, or disable the feature entirely if operationally feasible; simultaneously review the past 30 days of device-pairing logs for suspicious activity. Within 7 days, conduct a detailed privilege-escalation analysis, implement additional authentication requirements for sensitive operations, and establish alerting on abnormal device-pairing requests. Within 30 days, monitor vendor advisories for OpenClaw 2026.5.18 or later releases addressing CWE-863, and execute an expedited upgrade plan as soon as patches are available.

OpenClaw EUVD-2026-45111

Q: What is the CVSS score of EUVD-2026-45111?

EUVD-2026-45111 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-62223 HIGH

Incorrect Authorization (CWE-863)

2026-07-17 VulnCheck

GHSA-ww99-rc68-x2pj

Authentication Bypass Openclaw

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Authenticated low-trust caller (PR:L) over the network; AC:H reflects the required feature-enabled/misconfigured-path precondition; unchanged scope with full CIA impact on the affected system.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:56 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 7.7

DescriptionCVE.org

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable.

AnalysisAI

Authorization bypass in OpenClaw before 2026.5.18 lets low-privileged, authenticated callers escalate their actions through the device-pair approval feature, executing or persisting operations beyond their intended trust level. The flaw stems from improper authorization checks (CWE-863) on device-pairing input paths, and per the CVSS 4.0 vector it fully compromises confidentiality, integrity, and availability of the affected system. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

OpenClaw exposes a device-pair approval feature intended to gate which callers may approve or act on device pairing requests. The root cause is CWE-863 (Incorrect Authorization): the code reaches an authorization decision but applies it incorrectly, so a caller holding only lower-trust credentials can pass through 'misconfigured input paths' and invoke privileged pairing actions. The single CPE provided (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is version-unbounded, meaning all releases prior to the 2026.5.18 fix are considered in scope. This is an application-layer logic flaw rather than a memory-safety or injection issue, so the defect lives in the trust/permission model of the pairing workflow itself.

RemediationAI

Vendor-released patch: 2026.5.18 - upgrade OpenClaw to 2026.5.18 or later, which is the primary and complete fix; consult GHSA-hx85-fgcw-9vrc (https://github.com/openclaw/openclaw/security/advisories/GHSA-hx85-fgcw-9vrc) for release details. If you cannot upgrade immediately, reduce exposure by disabling or restricting the device-pair approval feature so it is not reachable by low-trust accounts, and tighten access controls so only fully trusted principals can reach the pairing endpoints - the trade-off is that disabling pairing breaks legitimate device onboarding workflows until the patch is applied. Additionally audit and correct the 'misconfigured input paths' referenced in the advisory and review pairing-approval logs for unexpected actions by low-privilege users. Because the flaw requires an authenticated foothold, revoking or scrutinizing low-trust accounts limits blast radius as an interim control.