CVE-2026-62196: OpenClaw WhatsApp group ID spoof

CISO Take

OpenClaw, an AI agent framework, contains an authorization bypass (CVSS 8.3, CWE-863) where the system incorrectly treats a WhatsApp group ID as proof of elevated sender trust, letting a low-privilege user perform actions meant only for higher-trust senders over the network with no user interaction required. There's no public exploit code, no CISA KEV listing, and no EPSS score yet, so exploitation likelihood can't be quantified from external signals, but the flaw sits directly in the agent's authorization logic — the exact trust boundary that determines which actions an AI agent will execute on a user's behalf. Any deployment where OpenClaw mediates WhatsApp-integrated agent actions (customer support automation, internal ops bots) is exposed to confidentiality and integrity impact if a low-trust group member escalates to elevated agent capabilities. Patch to OpenClaw 2026.6.6 or later immediately; until then, audit any allowlist or trust configuration that keys off group identifiers rather than verified sender identity, and review agent action logs for elevated operations originating from unexpected group contexts.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

High risk given the network attack vector, low complexity, and low privilege requirement (an attacker only needs some form of low-trust access, not admin rights), combined with no required user interaction. Confidentiality and integrity impact are both high (C:H/I:H), meaning a successful bypass could expose sensitive data processed by the agent or let the attacker trigger consequential actions; availability impact is limited (A:L). Exploitation probability cannot be benchmarked via EPSS (no score published) and there is no evidence of in-the-wild exploitation or a public PoC/Nuclei template, which tempers urgency somewhat — but trust conflation between a messaging platform identifier and an authorization decision is a common and easily-abused pattern once publicly documented, especially in agent frameworks where 'elevated' typically means broader tool access.

How does the attack unfold?

Initial Access

Attacker holds low-trust access to the AI agent via a WhatsApp group with lower privilege standing.

AML.T0012

Authorization Bypass

Attacker exploits the flawed group ID validation so the low-trust group is misclassified as satisfying the elevated sender allowlist (CWE-863).

AML.T0107

Elevated Tool Invocation

The agent grants the attacker access to actions and tool invocations reserved for higher-trust senders.

AML.T0053

Impact

Attacker performs unauthorized actions with high confidentiality and integrity impact, such as exposing sensitive data or triggering privileged operations.

Initial Access

Attacker holds low-trust access to the AI agent via a WhatsApp group with lower privilege standing.

AML.T0012

Authorization Bypass

Attacker exploits the flawed group ID validation so the low-trust group is misclassified as satisfying the elevated sender allowlist (CWE-863).

AML.T0107

Elevated Tool Invocation

The agent grants the attacker access to actions and tool invocations reserved for higher-trust senders.

AML.T0053

Impact

Attacker performs unauthorized actions with high confidentiality and integrity impact, such as exposing sensitive data or triggering privileged operations.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A Low

What should I do?

1 step

Upgrade OpenClaw to version 2026.6.6 or later, which fixes the group ID validation logic (see GHSA-fh38-965w-f6c3). As an interim workaround, audit any sender/group allowlist configuration and remove reliance on WhatsApp group IDs alone as an elevated-trust signal — require an additional verified identity factor for privileged actions. Review agent action/audit logs for elevated operations triggered from group contexts that shouldn't hold that trust level, and add detection rules flagging privileged tool invocations originating from newly-seen or low-reputation group IDs. Track the VulnCheck advisory for updates on exploitation activity given the absence of an EPSS score.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system access control

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62196?

OpenClaw, an AI agent framework, contains an authorization bypass (CVSS 8.3, CWE-863) where the system incorrectly treats a WhatsApp group ID as proof of elevated sender trust, letting a low-privilege user perform actions meant only for higher-trust senders over the network with no user interaction required. There's no public exploit code, no CISA KEV listing, and no EPSS score yet, so exploitation likelihood can't be quantified from external signals, but the flaw sits directly in the agent's authorization logic — the exact trust boundary that determines which actions an AI agent will execute on a user's behalf. Any deployment where OpenClaw mediates WhatsApp-integrated agent actions (customer support automation, internal ops bots) is exposed to confidentiality and integrity impact if a low-trust group member escalates to elevated agent capabilities. Patch to OpenClaw 2026.6.6 or later immediately; until then, audit any allowlist or trust configuration that keys off group identifiers rather than verified sender identity, and review agent action logs for elevated operations originating from unexpected group contexts.

Is CVE-2026-62196 actively exploited?

No confirmed active exploitation of CVE-2026-62196 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62196?

Upgrade OpenClaw to version 2026.6.6 or later, which fixes the group ID validation logic (see GHSA-fh38-965w-f6c3). As an interim workaround, audit any sender/group allowlist configuration and remove reliance on WhatsApp group IDs alone as an elevated-trust signal — require an additional verified identity factor for privileged actions. Review agent action/audit logs for elevated operations triggered from group contexts that shouldn't hold that trust level, and add detection rules flagging privileged tool invocations originating from newly-seen or low-reputation group IDs. Track the VulnCheck advisory for updates on exploitation activity given the absence of an EPSS score.

What systems are affected by CVE-2026-62196?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-62196?

CVE-2026-62196 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.

Exploitation Scenario

An attacker gains access to a WhatsApp group with low trust standing — for example, by being added to a general customer-facing group monitored by the OpenClaw agent. By exploiting the flawed group ID validation, the attacker's messages are misclassified as originating from an elevated-trust sender, allowing them to issue commands that trigger the agent's higher-privilege tool invocations (e.g., pulling internal data, modifying configurations, or executing administrative workflows) — actions that should have required verified elevated access.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.