CVE-2026-62192: OpenClaw authz bypass

CISO Take

OpenClaw, an AI agent framework used to automate Discord guild operations, contains an authorization bypass (CWE-863) that lets a caller with only low privileges trigger guild actions meant to require stronger authorization — the flaw skips a cross-provider requester check on certain input paths. For a CISO this matters because Discord-integrated agents are typically wired with broad guild permissions (channel management, moderation, member actions), so a successful bypass carries high integrity and availability impact (CVSS 8.1, C:N/I:H/A:H) and needs no user interaction or elevated privilege to trigger (AC:L, PR:L, UI:N). There is no public exploit or Nuclei template, it is not in CISA KEV, and its EPSS score (0.00248) is low in absolute terms even though it ranks in the 84th percentile for its cohort — a real but not yet weaponized risk. Only 4 known downstream dependents cap the immediate blast radius, but the package's history of 447 other CVEs is a signal to weight into any broader OpenClaw risk decision. Patch to OpenClaw 2026.6.9 or later now, and in the meantime audit which Discord guild actions are reachable by lower-trust bots or integrations and add compensating server-side authorization checks on those input paths.

Sources: NVD EPSS GitHub Advisory vulncheck.com ATLAS

What is the risk?

Technically high severity: the bypass is network-reachable, requires only low privilege, no user interaction, and low attack complexity (AV:N/AC:L/PR:L/UI:N), making it straightforward to trigger for anyone who already holds a low-trust caller role in an OpenClaw-managed Discord integration. Impact is confined to integrity and availability (I:H/A:H, C:N) — attackers can perform unauthorized guild-management actions but the flaw itself does not directly leak data. Real-world urgency is currently moderate rather than critical: no CISA KEV listing, no public exploit or scanner template, and a low absolute EPSS score suggest active mass exploitation is unlikely today, but the low bar to trigger (once an attacker has any foothold) and the high CVSS mean this should not sit unpatched.

How does the attack unfold?

Initial Access

Attacker holds or obtains a low-trust Discord account/bot integration connected to an OpenClaw-managed guild.

AML.T0012

Exploitation

Attacker crafts a request through the vulnerable guild-action input path, skipping the cross-provider requester authorization check.

AML.T0107

Unauthorized Tool Invocation

OpenClaw's agent executes a restricted Discord guild action (e.g., role changes, bans, channel deletion) believing the caller is sufficiently privileged.

AML.T0053

Impact

Unauthorized administrative changes and service disruption occur within the Discord guild, affecting integrity and availability of the community/ops environment.

Initial Access

Attacker holds or obtains a low-trust Discord account/bot integration connected to an OpenClaw-managed guild.

AML.T0012

Exploitation

Attacker crafts a request through the vulnerable guild-action input path, skipping the cross-provider requester authorization check.

AML.T0107

Unauthorized Tool Invocation

OpenClaw's agent executes a restricted Discord guild action (e.g., role changes, bans, channel deletion) believing the caller is sufficiently privileged.

AML.T0053

Impact

Unauthorized administrative changes and service disruption occur within the Discord guild, affecting integrity and availability of the community/ops environment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

1 step

Upgrade OpenClaw to 2026.6.9 or later immediately (fixed per GHSA-3pmr-x9g8-m55r). Until patched, audit which Discord guild-action input paths are reachable by lower-trust bots, integrations, or user roles, and add independent server-side authorization checks that do not rely on the vulnerable cross-provider requester validation. Apply least-privilege Discord bot/agent permissions so a bypass has less to abuse even if triggered. Monitor guild audit logs for privileged actions (role changes, bans, channel deletion) originating from low-trust identities, and alert on anomalous action patterns from non-admin callers.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI system life cycle - operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62192?

OpenClaw, an AI agent framework used to automate Discord guild operations, contains an authorization bypass (CWE-863) that lets a caller with only low privileges trigger guild actions meant to require stronger authorization — the flaw skips a cross-provider requester check on certain input paths. For a CISO this matters because Discord-integrated agents are typically wired with broad guild permissions (channel management, moderation, member actions), so a successful bypass carries high integrity and availability impact (CVSS 8.1, C:N/I:H/A:H) and needs no user interaction or elevated privilege to trigger (AC:L, PR:L, UI:N). There is no public exploit or Nuclei template, it is not in CISA KEV, and its EPSS score (0.00248) is low in absolute terms even though it ranks in the 84th percentile for its cohort — a real but not yet weaponized risk. Only 4 known downstream dependents cap the immediate blast radius, but the package's history of 447 other CVEs is a signal to weight into any broader OpenClaw risk decision. Patch to OpenClaw 2026.6.9 or later now, and in the meantime audit which Discord guild actions are reachable by lower-trust bots or integrations and add compensating server-side authorization checks on those input paths.

Is CVE-2026-62192 actively exploited?

No confirmed active exploitation of CVE-2026-62192 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62192?

Upgrade OpenClaw to 2026.6.9 or later immediately (fixed per GHSA-3pmr-x9g8-m55r). Until patched, audit which Discord guild-action input paths are reachable by lower-trust bots, integrations, or user roles, and add independent server-side authorization checks that do not rely on the vulnerable cross-provider requester validation. Apply least-privilege Discord bot/agent permissions so a bypass has less to abuse even if triggered. Monitor guild audit logs for privileged actions (role changes, bans, channel deletion) originating from low-trust identities, and alert on anomalous action patterns from non-admin callers.

What systems are affected by CVE-2026-62192?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool orchestration, cross-platform agent integrations.

What is the CVSS score for CVE-2026-62192?

CVE-2026-62192 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool orchestrationcross-platform agent integrations

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester authorization and execute restricted operations.

Exploitation Scenario

An attacker who controls or compromises a low-trust Discord account or bot integration connected to an OpenClaw-managed guild sends a crafted request through the vulnerable guild-action input path. Because the cross-provider requester authorization check is skipped, OpenClaw's handler treats the caller as sufficiently privileged and the agent invokes a restricted guild-management tool on the attacker's behalf — for example mass-kicking members, deleting channels, or altering roles — causing service disruption and unauthorized administrative changes without the attacker ever needing legitimate admin credentials.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.