CVE-2026-62190: OpenClaw auth bypass skips agent exec

CISO Take

OpenClaw's flock wrapper contains an authorization bypass (CVSS 8.8) that lets lower-trust callers execute or persist actions beyond their intended permissions by abusing configured input paths to escape the durable exec approval binding — the mechanism meant to gate what an AI agent is allowed to run without repeated human sign-off. This matters because it undermines the core safety control for agentic execution: an attacker with only low privileges and no user interaction, over the network, can inherit a higher-trust approval and get code executed or persisted on their behalf. There's no public exploit or Nuclei template yet and it isn't in CISA KEV, and EPSS sits low at 0.285%, so this isn't under active mass exploitation today — but openclaw already carries 447 other CVEs and a 0/100 package risk score, signaling a track record of security debt in a component many agent deployments depend on. Patch to OpenClaw 2026.6.9 or later immediately; if you can't patch now, disable or restrict the affected input-path/flock-wrapper feature and audit recent exec approvals for actions that don't match the requesting caller's trust level.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS vulncheck.com

What is the risk?

High risk despite low current exploitation telemetry. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) means a remote attacker with only low-level privileges and no victim interaction can achieve high confidentiality, integrity, and availability impact — a rare combination for an authorization flaw. The absence of a public exploit, Nuclei template, or CISA KEV listing, plus a modest EPSS score (0.285%), suggests exploitation isn't yet automated or widespread, but the low complexity (AC:L) means a working exploit could be trivial to weaponize once details circulate. The 447 other CVEs in the openclaw package and its 0/100 risk score indicate systemic quality issues that make this specific bug plausible to have siblings, and the durable-approval-binding design pattern it breaks is exactly the kind of control CISOs rely on to bound agent autonomy.

How does the attack unfold?

Entry

A lower-trust caller with low privileges and network access sends a request through the OpenClaw flock wrapper using a crafted configured input path.

AML.T0049

Exploitation

The flock wrapper mis-resolves the input path and incorrectly applies an existing higher-trust durable exec approval binding to the request (CWE-706/CWE-863).

AML.T0107

Unauthorized Execution

The agent executes or persists the requested action as if it had been legitimately approved, invoking tools or operations beyond the caller's actual authorization.

AML.T0053

Impact

The attacker achieves high-impact confidentiality, integrity, and availability consequences — unauthorized code execution, data manipulation, or persistent unauthorized agent behavior.

AML.T0108

Entry

A lower-trust caller with low privileges and network access sends a request through the OpenClaw flock wrapper using a crafted configured input path.

AML.T0049

Exploitation

The flock wrapper mis-resolves the input path and incorrectly applies an existing higher-trust durable exec approval binding to the request (CWE-706/CWE-863).

AML.T0107

Unauthorized Execution

The agent executes or persists the requested action as if it had been legitimately approved, invoking tools or operations beyond the caller's actual authorization.

AML.T0053

Impact

The attacker achieves high-impact confidentiality, integrity, and availability consequences — unauthorized code execution, data manipulation, or persistent unauthorized agent behavior.

AML.T0108

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch to OpenClaw 2026.6.9+ immediately — this is the primary and only complete fix. 2) If patching is delayed, disable the specific feature/flag that enables the affected input-path handling in the flock wrapper (per the vendor advisory GHSA-3fp5-v549-9v66) until upgraded. 3) Audit exec-approval logs for any action executed by a caller whose trust level doesn't match the approval's original scope — look for approval reuse across different caller identities or sessions. 4) Restrict which callers/roles can configure input paths feeding the flock wrapper as a compensating control. 5) Monitor the 4 known downstream dependents of openclaw for their own patch releases, since they may embed the vulnerable version transitively.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - AI system operational controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62190?

OpenClaw's flock wrapper contains an authorization bypass (CVSS 8.8) that lets lower-trust callers execute or persist actions beyond their intended permissions by abusing configured input paths to escape the durable exec approval binding — the mechanism meant to gate what an AI agent is allowed to run without repeated human sign-off. This matters because it undermines the core safety control for agentic execution: an attacker with only low privileges and no user interaction, over the network, can inherit a higher-trust approval and get code executed or persisted on their behalf. There's no public exploit or Nuclei template yet and it isn't in CISA KEV, and EPSS sits low at 0.285%, so this isn't under active mass exploitation today — but openclaw already carries 447 other CVEs and a 0/100 package risk score, signaling a track record of security debt in a component many agent deployments depend on. Patch to OpenClaw 2026.6.9 or later immediately; if you can't patch now, disable or restrict the affected input-path/flock-wrapper feature and audit recent exec approvals for actions that don't match the requesting caller's trust level.

Is CVE-2026-62190 actively exploited?

No confirmed active exploitation of CVE-2026-62190 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62190?

1) Patch to OpenClaw 2026.6.9+ immediately — this is the primary and only complete fix. 2) If patching is delayed, disable the specific feature/flag that enables the affected input-path handling in the flock wrapper (per the vendor advisory GHSA-3fp5-v549-9v66) until upgraded. 3) Audit exec-approval logs for any action executed by a caller whose trust level doesn't match the approval's original scope — look for approval reuse across different caller identities or sessions. 4) Restrict which callers/roles can configure input paths feeding the flock wrapper as a compensating control. 5) Monitor the 4 known downstream dependents of openclaw for their own patch releases, since they may embed the vulnerable version transitively.

What systems are affected by CVE-2026-62190?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic execution/approval pipelines, multi-tenant agent runtimes.

What is the CVSS score for CVE-2026-62190?

CVE-2026-62190 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic execution/approval pipelinesmulti-tenant agent runtimes

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

Exploitation Scenario

An organization deploys an OpenClaw-based agent runtime where a human approves a sensitive exec action once, and that approval is durably bound so the agent can repeat similar actions without re-prompting. A lower-trust caller — for example, a scoped API integration, a lower-privilege user session, or an indirectly-triggered agent skill — crafts an input path that the flock wrapper mis-resolves (CWE-706) due to incorrect authorization checks (CWE-863). This causes the wrapper to treat the caller's request as covered by an existing higher-trust durable approval binding. The agent then executes or persists an action the caller was never authorized to request — such as running a privileged tool, writing to a protected location, or triggering a downstream integration — with no additional user interaction or elevated credentials needed from the attacker.

Weaknesses (CWE)

CWE-706 Use of Incorrectly-Resolved Name or Reference Primary CWE-863 Incorrect Authorization Primary CWE-706 Use of Incorrectly-Resolved Name or Reference CWE-863 Incorrect Authorization

CWE-706 — Use of Incorrectly-Resolved Name or Reference: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Source: MITRE CWE corpus.