CVE-2026-62195: OpenClaw MCP loopback auth bypass on

CISO Take

OpenClaw's MCP loopback feature fails to properly enforce trust boundaries between callers, letting a caller with only low-level privileges invoke tools that should be restricted to the agent's owner. This matters because agentic pipelines built on OpenClaw often wire owner-scoped tools to sensitive actions — file writes, credential access, downstream API calls — so a bypass here converts a low-privilege foothold into owner-level tool execution, with confidentiality and integrity impact rated high in the CVSS vector (AV:N/AC:L/PR:L/UI:N). There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks unweaponized today, but the attack path itself is cheap — network-reachable, low complexity, no user interaction required. Teams running OpenClaw between versions 2026.5.20 and 2026.6.6 should patch to 2026.6.6 immediately and, in the interim, audit MCP loopback configuration for any input paths that aren't scoped to the intended caller trust level. Watch logs for tool invocations from lower-trust identities that touch owner-only tool names as a detection signal.

Sources: NVD GitHub Advisory CISA KEV EPSS ATLAS vulncheck.com

What is the risk?

CVSS 8.3 (High) reflects a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality and integrity impact — a favorable exploitability profile for an attacker who already has any foothold in the MCP loopback path. Actual exploitation risk today is unconfirmed: EPSS is not available, the CVE is not in CISA KEV, and there is no public exploit code or Nuclei scanning template, so there's no evidence of active or automated exploitation yet. The package risk score is 0/100 largely due to missing metadata (unknown dependents, no OpenSSF Scorecard, unknown push activity) rather than a clean bill of health — treat that score as 'insufficient data,' not 'low risk.' Given the low bar to exploit (PR:L, AC:L) and the authorization-bypass class (CWE-732), this should be prioritized for patching ahead of confirmed-exploited but harder-to-reach vulnerabilities.

How does the attack unfold?

Initial access

Attacker obtains a low-privilege caller identity or endpoint with network access to OpenClaw's MCP loopback interface.

AML.T0012

Authorization bypass

Attacker sends a request through a configured input path that evades the owner-only authorization check on the MCP loopback feature.

AML.T0107

Unauthorized tool invocation

The bypass lets the attacker invoke tools reserved for the owner role, executing actions outside their intended permission scope.

AML.T0053

Persistence / impact

Attacker persists the unauthorized actions or state changes, achieving lasting impact with high confidentiality and integrity loss.

AML.T0081

Initial access

Attacker obtains a low-privilege caller identity or endpoint with network access to OpenClaw's MCP loopback interface.

AML.T0012

Authorization bypass

Attacker sends a request through a configured input path that evades the owner-only authorization check on the MCP loopback feature.

AML.T0107

Unauthorized tool invocation

The bypass lets the attacker invoke tools reserved for the owner role, executing actions outside their intended permission scope.

AML.T0053

Persistence / impact

Attacker persists the unauthorized actions or state changes, achieving lasting impact with high confidentiality and integrity loss.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A Low

What should I do?

1 step

Upgrade OpenClaw to version 2026.6.6 or later immediately — this is the primary and only confirmed fix per the vendor advisory. Until patched, audit and restrict MCP loopback input path configuration so lower-trust callers cannot reach owner-scoped tool endpoints, and review which tools are marked owner-only versus caller-accessible. Add detection for anomalous tool invocations: alert when a non-owner caller identity triggers tools historically only exercised by the owner role, and review persisted agent state/config for unexpected changes following any suspected exploitation window. Reference the GitHub Security Advisory (GHSA-52xj-c9p8-78cv) and VulnCheck advisory for authoritative technical details and any future updates.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system security controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62195?

OpenClaw's MCP loopback feature fails to properly enforce trust boundaries between callers, letting a caller with only low-level privileges invoke tools that should be restricted to the agent's owner. This matters because agentic pipelines built on OpenClaw often wire owner-scoped tools to sensitive actions — file writes, credential access, downstream API calls — so a bypass here converts a low-privilege foothold into owner-level tool execution, with confidentiality and integrity impact rated high in the CVSS vector (AV:N/AC:L/PR:L/UI:N). There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks unweaponized today, but the attack path itself is cheap — network-reachable, low complexity, no user interaction required. Teams running OpenClaw between versions 2026.5.20 and 2026.6.6 should patch to 2026.6.6 immediately and, in the interim, audit MCP loopback configuration for any input paths that aren't scoped to the intended caller trust level. Watch logs for tool invocations from lower-trust identities that touch owner-only tool names as a detection signal.

Is CVE-2026-62195 actively exploited?

No confirmed active exploitation of CVE-2026-62195 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62195?

Upgrade OpenClaw to version 2026.6.6 or later immediately — this is the primary and only confirmed fix per the vendor advisory. Until patched, audit and restrict MCP loopback input path configuration so lower-trust callers cannot reach owner-scoped tool endpoints, and review which tools are marked owner-only versus caller-accessible. Add detection for anomalous tool invocations: alert when a non-owner caller identity triggers tools historically only exercised by the owner role, and review persisted agent state/config for unexpected changes following any suspected exploitation window. Reference the GitHub Security Advisory (GHSA-52xj-c9p8-78cv) and VulnCheck advisory for authoritative technical details and any future updates.

What systems are affected by CVE-2026-62195?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool orchestration, multi-agent systems.

What is the CVSS score for CVE-2026-62195?

CVE-2026-62195 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool orchestrationmulti-agent systems

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.

Exploitation Scenario

An attacker who has obtained low-privilege access to an OpenClaw-orchestrated agent environment — for example, a scoped API integration, a lower-trust sub-agent, or a compromised low-privilege service account — crafts a request through one of the MCP loopback's configured input paths that bypasses the authorization check meant to gate owner-only tools. Instead of being restricted to their intended tool set, the attacker's request is routed to and executed by an owner-scoped tool, letting them perform or persist actions (e.g., writing files, modifying agent configuration, calling privileged downstream integrations) that should have required owner-level trust — effectively achieving privilege escalation within the agent's tool-execution layer without needing to compromise credentials directly.

Weaknesses (CWE)

CWE-732 Incorrect Permission Assignment for Critical Resource Primary CWE-732 Incorrect Permission Assignment for Critical Resource

CWE-732 — Incorrect Permission Assignment for Critical Resource: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

[Implementation] When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]

Source: MITRE CWE corpus.