CVE-2026-62186: OpenClaw model override bypasses

CISO Take

OpenClaw before version 2026.6.8 fails to properly enforce authorization on its OpenAI-compatible HTTP model override path, letting a caller with only low privileges trigger operations that should require admin-level authorization. This matters because OpenClaw is an agent framework, meaning a bypass here can translate directly into unauthorized agent actions rather than just data exposure, and OpenClaw's own incident history (agents ignoring stop commands, malicious third-party skills) shows this platform already struggles with keeping agent behavior inside intended bounds. No public exploit code or Nuclei template exists yet and it is not in CISA KEV, and the EPSS score of 0.00192 indicates low near-term exploitation probability in absolute terms even though it ranks in the 91st percentile relative to other CVEs. Patch to OpenClaw 2026.6.8 or later immediately; in the interim, restrict which callers can supply model-override parameters/headers at the network or gateway layer and audit access logs for low-privilege accounts invoking admin-scoped model endpoints.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

CVSS 7.6 (High) reflects a network-exploitable, low-complexity flaw requiring only low privileges and no user interaction, which meaningfully lowers the bar for exploitation. Impact is asymmetric: confidentiality is rated High while integrity and availability are only Low, suggesting the primary risk is unauthorized read access or exposure of admin-gated data/state rather than full system takeover. Exposure is currently mitigated by the absence of a public PoC, scanner template, or KEV listing, and a low absolute EPSS score — but the combination of no-auth-required network access and a widely deployed agent framework (447 other CVEs recorded in this package, 4 downstream dependents) means this should be treated as a real, if not yet weaponized, threat.

How does the attack unfold?

Low-trust API access

Attacker uses a low-privileged API key or service account to reach OpenClaw's OpenAI-compatible HTTP endpoint over the network.

AML.T0049

Authorization bypass via model override

Attacker crafts an HTTP request with a model-override parameter that exploits the misconfigured input path, bypassing the admin authorization check.

AML.T0107

Restricted operation execution

The bypass allows the low-trust caller to invoke operations or agent capabilities that should have required stronger, admin-level authorization.

AML.T0053

Unauthorized data/action impact

Attacker obtains unauthorized access to sensitive data or triggers unintended actions, consistent with the CVSS High confidentiality and Low integrity/availability impact.

Low-trust API access

Attacker uses a low-privileged API key or service account to reach OpenClaw's OpenAI-compatible HTTP endpoint over the network.

AML.T0049

Authorization bypass via model override

Attacker crafts an HTTP request with a model-override parameter that exploits the misconfigured input path, bypassing the admin authorization check.

AML.T0107

Restricted operation execution

The bypass allows the low-trust caller to invoke operations or agent capabilities that should have required stronger, admin-level authorization.

AML.T0053

Unauthorized data/action impact

Attacker obtains unauthorized access to sensitive data or triggers unintended actions, consistent with the CVSS High confidentiality and Low integrity/availability impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A Low

What should I do?

1 step

1) Upgrade OpenClaw to 2026.6.8 or later immediately — see GHSA-jhfx-v2j8-x3m6. 2) Until patched, restrict or strip client-supplied model-override headers/parameters at a reverse proxy or API gateway so only trusted internal callers can set them. 3) Review authorization logic around any HTTP path accepting OpenAI-compatible model overrides and confirm admin checks are enforced server-side, not inferred from client input. 4) Audit access/authorization logs for low-privilege identities invoking admin-scoped operations or unexpected model-override values. 5) Apply least-privilege API key scoping so lower-trust callers cannot reach admin-gated endpoints at all, as defense in depth.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent API AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system access control

NIST AI RMF

GOVERN 1.5 - Mechanisms for appropriate access and oversight of AI system operations

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62186?

OpenClaw before version 2026.6.8 fails to properly enforce authorization on its OpenAI-compatible HTTP model override path, letting a caller with only low privileges trigger operations that should require admin-level authorization. This matters because OpenClaw is an agent framework, meaning a bypass here can translate directly into unauthorized agent actions rather than just data exposure, and OpenClaw's own incident history (agents ignoring stop commands, malicious third-party skills) shows this platform already struggles with keeping agent behavior inside intended bounds. No public exploit code or Nuclei template exists yet and it is not in CISA KEV, and the EPSS score of 0.00192 indicates low near-term exploitation probability in absolute terms even though it ranks in the 91st percentile relative to other CVEs. Patch to OpenClaw 2026.6.8 or later immediately; in the interim, restrict which callers can supply model-override parameters/headers at the network or gateway layer and audit access logs for low-privilege accounts invoking admin-scoped model endpoints.

Is CVE-2026-62186 actively exploited?

No confirmed active exploitation of CVE-2026-62186 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62186?

1) Upgrade OpenClaw to 2026.6.8 or later immediately — see GHSA-jhfx-v2j8-x3m6. 2) Until patched, restrict or strip client-supplied model-override headers/parameters at a reverse proxy or API gateway so only trusted internal callers can set them. 3) Review authorization logic around any HTTP path accepting OpenAI-compatible model overrides and confirm admin checks are enforced server-side, not inferred from client input. 4) Audit access/authorization logs for low-privilege identities invoking admin-scoped operations or unexpected model-override values. 5) Apply least-privilege API key scoping so lower-trust callers cannot reach admin-gated endpoints at all, as defense in depth.

What systems are affected by CVE-2026-62186?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, API gateways / model routing, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-62186?

CVE-2026-62186 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingAPI gateways / model routingmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: GOVERN 1.5

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

Exploitation Scenario

An attacker holding a low-privilege API key or service account credential for an OpenClaw deployment sends a request to the OpenAI-compatible HTTP endpoint, including a crafted model-override parameter that targets an admin-restricted model or configuration path. Because the authorization check on that input path is misconfigured, OpenClaw treats the request as sufficiently privileged and executes an operation intended to require admin authorization — such as invoking a restricted agent capability or reading admin-scoped data — without ever validating the caller's actual trust level. Given OpenClaw's documented history of agents acting beyond intended bounds, a bypass like this could let a lower-trust integration or compromised low-privilege key escalate into agent actions well beyond its intended scope.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-863 Incorrect Authorization Primary CWE-862 Missing Authorization CWE-863 Incorrect Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.