CVE-2026-62188: OpenClaw authz bypass ignores

CISO Take

OpenClaw's @openclaw/feishu plugin, which lets the AI agent perform actions inside Feishu (ByteDance's enterprise messaging/collaboration suite), contains an incorrect authorization flaw where its permission tools fail to check per-account disablement settings, so a caller whose account was supposed to be locked out can still invoke privileged actions (CWE-863, CVSS 8.1, confidentiality and integrity both rated High). There's no active exploitation signal here — it's not in CISA KEV, no public exploit or Nuclei template exists, and the EPSS score itself is low (0.00213), though it ranks in the top 12% of all scored CVEs by relative likelihood; blast radius is also contained, with only 4 known downstream dependents. The real risk is architectural: it breaks the assumption that disabling an account at the platform level also revokes that account's agent-mediated tool access, a common blind spot in agentic AI deployments. Teams running OpenClaw's Feishu integration should upgrade to 2026.6.9 immediately and audit whether any recently-disabled accounts issued Feishu permission-tool calls during the vulnerable window.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

Network-exploitable with low attack complexity and no user interaction, but requires low-level privileges (PR:L) — this is not an unauthenticated remote exploit, it's a confused-deputy/authorization-boundary failure exploitable by an account that should already be neutralized. Impact is High/High/None (confidentiality and integrity, no availability impact), consistent with unauthorized read/write access to Feishu content and permission state rather than system takeover. Exploitation pressure is currently low: no KEV listing, no public PoC, no scanner template, and a sub-1% raw EPSS score, though its 88th-percentile ranking places it above most CVEs in relative priority. Combined with a small blast radius (4 downstream dependents), this is a real-but-contained risk — patch on normal cadence, not emergency, unless the org has active offboarding/insider-risk concerns tied to Feishu-integrated agents.

How does the attack unfold?

Low-trust account access

An account that was supposed to be disabled retains a valid low-privilege credential or session usable against the OpenClaw Feishu integration.

AML.T0012

Authorization check bypass

OpenClaw's Feishu permission tool fails to enforce per-account disablement settings, incorrectly authorizing the tool invocation (CWE-863).

AML.T0053

Unauthorized Feishu action

The agent executes Feishu permission or messaging actions on the caller's behalf that should have been blocked, exposing or altering data with high confidentiality and integrity impact.

AML.T0086

Low-trust account access

An account that was supposed to be disabled retains a valid low-privilege credential or session usable against the OpenClaw Feishu integration.

AML.T0012

Authorization check bypass

OpenClaw's Feishu permission tool fails to enforce per-account disablement settings, incorrectly authorizing the tool invocation (CWE-863).

AML.T0053

Unauthorized Feishu action

The agent executes Feishu permission or messaging actions on the caller's behalf that should have been blocked, exposing or altering data with high confidentiality and integrity impact.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade @openclaw/feishu to 2026.6.9 or later immediately in any deployment where the agent has Feishu permission-tool access. Audit recently disabled/offboarded accounts to determine whether they issued any Feishu permission-tool calls through the OpenClaw agent during the vulnerable window (pre-2026.6.9). Add defense-in-depth by validating account status directly against the Feishu platform API at invocation time rather than relying solely on the agent's cached authorization state. Monitor agent logs for permission-management tool invocations (grant/revoke/modify) originating from accounts flagged as disabled. No workaround exists short of patching — CWE-863 (incorrect authorization) issues require the code fix, not configuration changes.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.3 - AI system access control and permissions

NIST AI RMF

MANAGE 4.1 - Risk treatment for deployed AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62188?

OpenClaw's @openclaw/feishu plugin, which lets the AI agent perform actions inside Feishu (ByteDance's enterprise messaging/collaboration suite), contains an incorrect authorization flaw where its permission tools fail to check per-account disablement settings, so a caller whose account was supposed to be locked out can still invoke privileged actions (CWE-863, CVSS 8.1, confidentiality and integrity both rated High). There's no active exploitation signal here — it's not in CISA KEV, no public exploit or Nuclei template exists, and the EPSS score itself is low (0.00213), though it ranks in the top 12% of all scored CVEs by relative likelihood; blast radius is also contained, with only 4 known downstream dependents. The real risk is architectural: it breaks the assumption that disabling an account at the platform level also revokes that account's agent-mediated tool access, a common blind spot in agentic AI deployments. Teams running OpenClaw's Feishu integration should upgrade to 2026.6.9 immediately and audit whether any recently-disabled accounts issued Feishu permission-tool calls during the vulnerable window.

Is CVE-2026-62188 actively exploited?

No confirmed active exploitation of CVE-2026-62188 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62188?

Upgrade @openclaw/feishu to 2026.6.9 or later immediately in any deployment where the agent has Feishu permission-tool access. Audit recently disabled/offboarded accounts to determine whether they issued any Feishu permission-tool calls through the OpenClaw agent during the vulnerable window (pre-2026.6.9). Add defense-in-depth by validating account status directly against the Feishu platform API at invocation time rather than relying solely on the agent's cached authorization state. Monitor agent logs for permission-management tool invocations (grant/revoke/modify) originating from accounts flagged as disabled. No workaround exists short of patching — CWE-863 (incorrect authorization) issues require the code fix, not configuration changes.

What systems are affected by CVE-2026-62188?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin.

What is the CVSS score for CVE-2026-62188?

CVE-2026-62188 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.3

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in version 2026.6.9.

Exploitation Scenario

An organization disables a Feishu account after an employee offboarding or a suspected compromise, expecting that action to cut off all access. Because OpenClaw's Feishu permission tools don't re-verify per-account disablement, the still-valid low-privilege session or credential tied to that disabled account can continue invoking the AI agent's Feishu permission-management tool — using the agent as a confused deputy to read confidential channel content, exfiltrate messages, or modify other users' permission grants, all while the security team believes the account is fully locked out.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.