CVE-2026-62194: OpenClaw privilege escalation

CISO Take

OpenClaw, an AI agent framework, has a privilege escalation flaw in its plugin install commands that lets lower-trust callers execute or persist actions beyond their intended authorization, driven by missing authorization checks and incorrect permission assignment (CWE-862, CWE-732). With a CVSS of 8.8 and a network vector requiring only low privileges and no user interaction, this is trivially reachable wherever the plugin install feature is exposed, and because it sits inside an AI agent's tool/plugin surface, a successful escalation can translate directly into broader control over the agent's capabilities and host access. There is no evidence of active exploitation yet — it is not in CISA KEV, no public exploit or Nuclei template exists, and EPSS data is unavailable — but the combination of network reachability, low complexity, and an AI-agent blast radius warrants prompt attention rather than routine patch-cycle treatment. Upgrade OpenClaw to 2026.6.9 or later immediately; if patching must wait, disable or gate the plugin install feature behind stricter authorization and audit recent plugin install events for calls from lower-trust identities or unexpected sources.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

High severity (CVSS 8.8) with network attack vector, low complexity, low privileges required, and no user interaction — an attractive profile for automated or opportunistic exploitation once details circulate. The absence of KEV listing, public exploit code, or a Nuclei template suggests exploitation has not yet been observed in the wild, and EPSS data is not available to quantify near-term likelihood, so treat this as high potential risk rather than confirmed active risk. The real driver of severity is context: this is a privilege-escalation bug in an AI agent's plugin install path, meaning a successful exploit can hand an attacker capabilities the agent itself holds — file system access, credentials, or further tool invocation — rather than a narrow, contained privilege gain.

How does the attack unfold?

Initial Access

A lower-trust, authenticated caller reaches the network-exposed plugin install command with only low privileges required.

AML.T0049

Exploitation

Missing authorization checks and incorrect permission assignment let the caller's request execute as if from a higher-trust identity.

AML.T0053

Persistence

The attacker installs a plugin under their control, which persists in the agent's configuration beyond the initial request.

AML.T0110

Impact

The attacker gains elevated privileges and can execute or persist unauthorized actions across the agent's tool and data surface.

AML.T0112.000

Initial Access

A lower-trust, authenticated caller reaches the network-exposed plugin install command with only low privileges required.

AML.T0049

Exploitation

Missing authorization checks and incorrect permission assignment let the caller's request execute as if from a higher-trust identity.

AML.T0053

Persistence

The attacker installs a plugin under their control, which persists in the agent's configuration beyond the initial request.

AML.T0110

Impact

The attacker gains elevated privileges and can execute or persist unauthorized actions across the agent's tool and data surface.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch to OpenClaw 2026.6.9 or later immediately — this is the primary fix per the vendor advisory. 2) If immediate patching isn't possible, disable the plugin install feature for any callers that don't strictly need it, and enforce role/permission checks in front of the install path at the application or gateway layer. 3) Audit input paths that trigger plugin install actions and confirm feature flags aren't accidentally exposing the functionality to lower-trust roles. 4) Review logs for plugin install events initiated by unexpected identities, service accounts, or low-privilege sessions since version 2026.5.20 was deployed. 5) After patching, verify that authorization checks are actually enforced on the plugin install endpoint (not just present in code) via a targeted test with a low-privilege caller.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.3 - AI risk treatment

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62194?

OpenClaw, an AI agent framework, has a privilege escalation flaw in its plugin install commands that lets lower-trust callers execute or persist actions beyond their intended authorization, driven by missing authorization checks and incorrect permission assignment (CWE-862, CWE-732). With a CVSS of 8.8 and a network vector requiring only low privileges and no user interaction, this is trivially reachable wherever the plugin install feature is exposed, and because it sits inside an AI agent's tool/plugin surface, a successful escalation can translate directly into broader control over the agent's capabilities and host access. There is no evidence of active exploitation yet — it is not in CISA KEV, no public exploit or Nuclei template exists, and EPSS data is unavailable — but the combination of network reachability, low complexity, and an AI-agent blast radius warrants prompt attention rather than routine patch-cycle treatment. Upgrade OpenClaw to 2026.6.9 or later immediately; if patching must wait, disable or gate the plugin install feature behind stricter authorization and audit recent plugin install events for calls from lower-trust identities or unexpected sources.

Is CVE-2026-62194 actively exploited?

No confirmed active exploitation of CVE-2026-62194 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62194?

1) Patch to OpenClaw 2026.6.9 or later immediately — this is the primary fix per the vendor advisory. 2) If immediate patching isn't possible, disable the plugin install feature for any callers that don't strictly need it, and enforce role/permission checks in front of the install path at the application or gateway layer. 3) Audit input paths that trigger plugin install actions and confirm feature flags aren't accidentally exposing the functionality to lower-trust roles. 4) Review logs for plugin install events initiated by unexpected identities, service accounts, or low-privilege sessions since version 2026.5.20 was deployed. 5) After patching, verify that authorization checks are actually enforced on the plugin install endpoint (not just present in code) via a targeted test with a low-privilege caller.

What systems are affected by CVE-2026-62194?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool extensibility systems, multi-tenant agent deployments.

What is the CVSS score for CVE-2026-62194?

CVE-2026-62194 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/tool extensibility systemsmulti-tenant agent deployments

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

Exploitation Scenario

An attacker with only low-level, authenticated access to an OpenClaw-based agent deployment — for instance a restricted API consumer, a sandboxed sub-agent, or a user with a limited role — sends a request to the plugin install command. Because the endpoint is missing proper authorization checks (CWE-862) and has incorrectly assigned permissions (CWE-732), the request is processed as if it came from a higher-trust caller. The attacker uses this to install a plugin under their control, which persists in the agent's configuration and now executes with elevated privileges — granting the attacker access to additional tools, data, or host-level capabilities the agent has, well beyond their original authorization scope.

Weaknesses (CWE)

CWE-732 Incorrect Permission Assignment for Critical Resource Primary CWE-862 Missing Authorization Primary CWE-732 Incorrect Permission Assignment for Critical Resource CWE-862 Missing Authorization

CWE-732 — Incorrect Permission Assignment for Critical Resource: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

[Implementation] When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]

Source: MITRE CWE corpus.