AI Threat Alert

CVE-2026-62190

HIGH
Published July 13, 2026

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform...

Full CISO analysis pending enrichment.

How severe is it?

CVSS 3.1
8.8 / 10
EPSS
N/A
Exploitation Status
No known exploitation
Sophistication
N/A

What is the attack surface?

AV AC PR UI S C I A
AV Network
AC Low
PR Low
UI None
S Unchanged
C High
I High
A High

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-62190?

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

Is CVE-2026-62190 actively exploited?

No confirmed active exploitation of CVE-2026-62190 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62190?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-62190?

CVE-2026-62190 has a CVSS v3.1 base score of 8.8 (HIGH).

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

Weaknesses (CWE)

CWE-706 Use of Incorrectly-Resolved Name or Reference Primary CWE-863 Incorrect Authorization Primary CWE-706 Use of Incorrectly-Resolved Name or Reference CWE-863 Incorrect Authorization

CWE-706 — Use of Incorrectly-Resolved Name or Reference: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Source: MITRE CWE corpus.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Timeline

Published
July 13, 2026
Last Modified
July 13, 2026
First Seen
July 13, 2026
Back to Threat Feed