CVE-2026-62191: OpenClaw authorization bypass

CISO Take

OpenClaw (versions 2026.6.6 through 2026.6.8) has an authorization bypass in its message mutation handling that lets lower-trust callers execute operations that should require stronger permission checks, effectively skipping requester authorization when a misconfigured input path is reachable. The blast radius looks contained on paper — only 4 known downstream dependents and no CISA KEV listing or public exploit/Nuclei coverage — but EPSS places this in the top 87% percentile for exploitation likelihood, and OpenClaw's package track record of 447 prior CVEs with a 0/100 risk score signals a codebase with persistent authorization hygiene problems. Because the CVSS vector shows integrity impact as High with no authentication beyond low privileges (PR:L) and no user interaction, an attacker who already holds any low-trust identity in a multi-tenant OpenClaw deployment could tamper with message state or trigger privileged agent actions they shouldn't reach. Patch to 2026.6.9 or later immediately, and if patching must wait, disable or restrict network reachability of the affected message mutation feature and audit access logs for mutation calls originating from low-privilege accounts. Given OpenClaw's documented history of agents acting on commands they shouldn't (see AIID #1542), treat any unpatched instance as a priority for review even though this specific CVE has no confirmed active exploitation yet.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

CVSS 7.1 (High) with AV:N/AC:L/PR:L/UI:N means this is remotely reachable, low-complexity, and needs no user interaction — only a low-privilege identity, which is a low bar in most multi-tenant or multi-agent OpenClaw deployments. Impact is asymmetric: Integrity is High (privileged operations can be forged), Availability is Low, and Confidentiality is unaffected, so this is primarily a tampering/privilege-escalation risk rather than a data-exposure one. Mitigating factors: EPSS is low in absolute terms (0.00221), there is no CISA KEV listing, no public exploit code, and no Nuclei template — so opportunistic mass exploitation is unlikely today. Aggravating factors: OpenClaw's package history (447 other CVEs, OpenSSF/package risk score of 0/100) suggests weak security engineering discipline in this codebase, raising the odds that related or follow-on authorization flaws surface. Net assessment: High severity, currently Low observed exploitation — patch on normal high-severity SLA, not emergency SLA, unless the affected feature is internet-facing and multi-tenant.

How does the attack unfold?

Entry point

A caller holding only low-level privileges reaches the network-exposed message mutation feature in an OpenClaw deployment where it is enabled.

AML.T0049

Authorization bypass

A crafted mutation request exploits the misconfigured input path, skipping the requester authorization check that should gate the operation.

AML.T0107

Privileged mutation

The attacker performs the privileged operation as if authorized, altering message/agent state beyond their intended access level.

AML.T0092

Impact

Integrity of agent message state is compromised and, depending on the operation triggered, availability of the affected feature can degrade.

Entry point

A caller holding only low-level privileges reaches the network-exposed message mutation feature in an OpenClaw deployment where it is enabled.

AML.T0049

Authorization bypass

A crafted mutation request exploits the misconfigured input path, skipping the requester authorization check that should gate the operation.

AML.T0107

Privileged mutation

The attacker performs the privileged operation as if authorized, altering message/agent state beyond their intended access level.

AML.T0092

Impact

Integrity of agent message state is compromised and, depending on the operation triggered, availability of the affected feature can degrade.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

Upgrade OpenClaw to 2026.6.9 or later immediately — this is the vendor-confirmed fix per the GitHub Security Advisory (GHSA-v7hx-r36p-f68m). If immediate patching isn't possible, disable or restrict network exposure of the affected message mutation feature/endpoint, and enforce network-level segmentation so only trusted internal callers can reach it. Review authorization logic around message mutation calls for any custom deployment configuration that might reintroduce the misconfigured input path even post-patch. For detection, audit logs for mutation requests originating from lower-privilege accounts/tokens that resulted in state changes normally reserved for higher-trust roles, and alert on any mutation calls lacking a corresponding authorization check trace. Given the package's high CVE count, plan for a broader authorization-model review of OpenClaw rather than treating this as an isolated one-off fix.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0092 - Manipulate User LLM Chat History AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.4 - AI system access control

NIST AI RMF

MANAGE-1.3 - Risk treatment for third-party/deployed AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62191?

OpenClaw (versions 2026.6.6 through 2026.6.8) has an authorization bypass in its message mutation handling that lets lower-trust callers execute operations that should require stronger permission checks, effectively skipping requester authorization when a misconfigured input path is reachable. The blast radius looks contained on paper — only 4 known downstream dependents and no CISA KEV listing or public exploit/Nuclei coverage — but EPSS places this in the top 87% percentile for exploitation likelihood, and OpenClaw's package track record of 447 prior CVEs with a 0/100 risk score signals a codebase with persistent authorization hygiene problems. Because the CVSS vector shows integrity impact as High with no authentication beyond low privileges (PR:L) and no user interaction, an attacker who already holds any low-trust identity in a multi-tenant OpenClaw deployment could tamper with message state or trigger privileged agent actions they shouldn't reach. Patch to 2026.6.9 or later immediately, and if patching must wait, disable or restrict network reachability of the affected message mutation feature and audit access logs for mutation calls originating from low-privilege accounts. Given OpenClaw's documented history of agents acting on commands they shouldn't (see AIID #1542), treat any unpatched instance as a priority for review even though this specific CVE has no confirmed active exploitation yet.

Is CVE-2026-62191 actively exploited?

No confirmed active exploitation of CVE-2026-62191 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62191?

Upgrade OpenClaw to 2026.6.9 or later immediately — this is the vendor-confirmed fix per the GitHub Security Advisory (GHSA-v7hx-r36p-f68m). If immediate patching isn't possible, disable or restrict network exposure of the affected message mutation feature/endpoint, and enforce network-level segmentation so only trusted internal callers can reach it. Review authorization logic around message mutation calls for any custom deployment configuration that might reintroduce the misconfigured input path even post-patch. For detection, audit logs for mutation requests originating from lower-privilege accounts/tokens that resulted in state changes normally reserved for higher-trust roles, and alert on any mutation calls lacking a corresponding authorization check trace. Given the package's high CVE count, plan for a broader authorization-model review of OpenClaw rather than treating this as an isolated one-off fix.

What systems are affected by CVE-2026-62191?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant agent systems, AI agent orchestration platforms.

What is the CVSS score for CVE-2026-62191?

CVE-2026-62191 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant agent systemsAI agent orchestration platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0092 Manipulate User LLM Chat History

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.4

NIST AI RMF: MANAGE-1.3

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.

Exploitation Scenario

In a multi-tenant OpenClaw deployment, an attacker holding a low-privilege account or API token (e.g., a restricted user role, a scoped integration, or a subordinate agent identity) sends a crafted request to the message mutation endpoint. Because the affected code path fails to properly check the requester's authorization level when the vulnerable feature is enabled and network-reachable, the request is processed as if it came from a higher-trust caller. The attacker uses this to mutate messages or conversation state belonging to other users/agents, or to trigger a privileged operation gated behind that mutation path — for example, altering an agent's message history to change downstream behavior, suppress audit trails, or force execution of an action a lower-trust identity should never be able to invoke directly.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-863 Incorrect Authorization Primary CWE-862 Missing Authorization CWE-863 Incorrect Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.