CVE-2026-62187: OpenClaw disabled accounts retain

CISO Take

OpenClaw's Feishu integration tools failed to consistently enforce per-account disablement, meaning a lower-trust caller or a configured input path could invoke privileged Feishu actions that should have been blocked by an authorization policy check. With a CVSS of 8.1 and confidentiality/integrity impact both rated High, a successful bypass could expose or alter sensitive Feishu (Lark) communications and documents in any AI agent deployment wiring this package into its tool layer. The blast radius looks modest today — only 4 known downstream dependents, no public exploit, no scanner template, and no CISA KEV listing, with EPSS at just 0.2% (though ranked in the top 88th percentile of scored CVEs) — so this isn't an imminent mass-exploitation risk, but the low bar to trigger it (network access, low privileges, no user interaction) makes it exploitable by any authenticated low-trust caller once reachable. Teams running OpenClaw's Feishu tools, especially in multi-tenant or multi-account agent setups, should upgrade to 2026.6.9 immediately and audit recent Feishu tool invocation logs for any actions attributed to accounts that were supposed to be disabled.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS vulncheck.com

What is the risk?

Rated High severity (CVSS 8.1) on exploitability grounds — network-reachable, low attack complexity, no user interaction, requiring only low privileges — which makes it easy to trigger for anyone who can reach the affected code path. However, real-world exploitation likelihood is currently low: EPSS is 0.00213, there is no CISA KEV entry, no public exploit code, and no Nuclei template exists. The confidentiality and integrity impact is High while availability is unaffected, indicating the primary risk is unauthorized data access/modification rather than service disruption. Exposure is scoped to organizations that rely on OpenClaw's per-account disablement as an actual security boundary (e.g., after offboarding an employee or a suspected account compromise) and have lower-trust callers or externally-influenced input paths able to reach the Feishu tool integration.

How does the attack unfold?

Entry point

A lower-trust caller or a configured input path reaches the OpenClaw Feishu tool integration over the network with only low privileges required.

AML.T0053

Authorization bypass

The per-account disablement policy check (CWE-863: Incorrect Authorization) is not enforced at the point of tool invocation, so the disabled account's access is not actually blocked.

AML.T0053

Unauthorized operation

The caller performs Feishu actions — reading or modifying workspace communications/documents — that should have required stronger authorization.

AML.T0086

Impact

Sensitive Feishu-hosted data is exposed or altered (confidentiality and integrity impact both High), undermining the account-level isolation the operator relied on.

Entry point

A lower-trust caller or a configured input path reaches the OpenClaw Feishu tool integration over the network with only low privileges required.

AML.T0053

Authorization bypass

The per-account disablement policy check (CWE-863: Incorrect Authorization) is not enforced at the point of tool invocation, so the disabled account's access is not actually blocked.

AML.T0053

Unauthorized operation

The caller performs Feishu actions — reading or modifying workspace communications/documents — that should have required stronger authorization.

AML.T0086

Impact

Sensitive Feishu-hosted data is exposed or altered (confidentiality and integrity impact both High), undermining the account-level isolation the operator relied on.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade @openclaw/feishu to version 2026.6.9 or later immediately. Until patched, treat any account-level disablement in OpenClaw's Feishu integration as unenforced and add an independent authorization check (e.g., at an API gateway or proxy in front of the Feishu tool calls) rather than relying solely on the package's internal policy. Audit Feishu tool invocation logs for actions performed by accounts that were marked disabled, particularly around offboarding events or suspected compromises. Rotate Feishu API credentials tied to any account that was intentionally disabled as a security control. Track the vendor advisory (GHSA-2q7j-2vhx-56g8) and VulnCheck advisory for updates.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2 - AI system access control and third-party component management

NIST AI RMF

MANAGE 1.3 - Responses to identified risks are documented and monitored

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62187?

OpenClaw's Feishu integration tools failed to consistently enforce per-account disablement, meaning a lower-trust caller or a configured input path could invoke privileged Feishu actions that should have been blocked by an authorization policy check. With a CVSS of 8.1 and confidentiality/integrity impact both rated High, a successful bypass could expose or alter sensitive Feishu (Lark) communications and documents in any AI agent deployment wiring this package into its tool layer. The blast radius looks modest today — only 4 known downstream dependents, no public exploit, no scanner template, and no CISA KEV listing, with EPSS at just 0.2% (though ranked in the top 88th percentile of scored CVEs) — so this isn't an imminent mass-exploitation risk, but the low bar to trigger it (network access, low privileges, no user interaction) makes it exploitable by any authenticated low-trust caller once reachable. Teams running OpenClaw's Feishu tools, especially in multi-tenant or multi-account agent setups, should upgrade to 2026.6.9 immediately and audit recent Feishu tool invocation logs for any actions attributed to accounts that were supposed to be disabled.

Is CVE-2026-62187 actively exploited?

No confirmed active exploitation of CVE-2026-62187 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62187?

Upgrade @openclaw/feishu to version 2026.6.9 or later immediately. Until patched, treat any account-level disablement in OpenClaw's Feishu integration as unenforced and add an independent authorization check (e.g., at an API gateway or proxy in front of the Feishu tool calls) rather than relying solely on the package's internal policy. Audit Feishu tool invocation logs for actions performed by accounts that were marked disabled, particularly around offboarding events or suspected compromises. Rotate Feishu API credentials tied to any account that was intentionally disabled as a security control. Track the vendor advisory (GHSA-2q7j-2vhx-56g8) and VulnCheck advisory for updates.

What systems are affected by CVE-2026-62187?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations, multi-tenant agent deployments.

What is the CVSS score for CVE-2026-62187?

CVE-2026-62187 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool integrationsmulti-tenant agent deployments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MANAGE 1.3

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue is fixed in version 2026.6.9. Impact depends on the operator's configuration and whether lower-trust input can reach the affected feature.

Exploitation Scenario

An organization disables a former employee's or a suspected-compromised account's access within OpenClaw's Feishu tool configuration, expecting that any tool call tied to that account identity will now be blocked. Because the authorization check doesn't correctly re-verify per-account disablement at the point of tool invocation, a lower-trust caller — for example, a separate lower-privileged agent session, or user-supplied input that reaches the configured Feishu tool path — can still trigger the same Feishu actions (reading messages/documents, posting content, or other operations the tool exposes) as if the account were still active. The attacker gains unauthorized read/write access to Feishu-hosted communications and documents without needing elevated privileges, exploiting the gap between the intended policy and the runtime authorization logic.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.