CVE-2026-62198: OpenClaw web search auth bypass

CISO Take

OpenClaw's native web search tool contains an incorrect-authorization flaw (CWE-863) that lets a lower-trust caller — such as a sub-agent or a lower-privilege plugin — reach code paths gated behind stronger policy checks, effectively letting it execute actions it shouldn't be authorized to perform. The CVSS score of 4.3 (network vector, low complexity, low privileges required, no user interaction, C:L/I:N/A:N) keeps the numeric severity moderate, but the real risk in agentic deployments is erosion of the trust boundary between components: any workflow that assumes the web-search tool enforces the same authorization tier as the rest of the agent is exposed. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template, so there is no evidence of active or imminent exploitation, and downstream-dependent/package-risk data for OpenClaw is currently unavailable — this reads as a hygiene fix rather than an active-exploitation emergency. Teams running OpenClaw-based agents should upgrade past version 2026.6.6 immediately and, in the interim, audit any workflow that grants the web search tool elevated scopes or chains it into privileged actions, since that is exactly the 'input path' this bug abuses.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Network-exploitable, low complexity, and requiring only low privileges makes this easy to trigger for anyone who already holds a lower-trust foothold in an OpenClaw deployment (e.g., a restricted sub-agent, plugin, or externally-facing component). The CVSS vector reports only a low confidentiality impact and no integrity/availability impact, but that likely understates real-world exposure: authorization-bypass bugs in agent tool-invocation paths (CWE-863) commonly permit whatever 'restricted operation' sits behind the bypassed check, which could include data access or further tool chaining depending on how a given deployment wires its web search tool. With no EPSS data, no KEV listing, and no public PoC or scanner template, likelihood of opportunistic mass exploitation is currently low — but the flaw is trivial to weaponize once understood, so the risk profile can shift quickly if a PoC surfaces.

How does the attack unfold?

Entry point

A lower-trust caller (sub-agent, plugin, or external component) invokes the OpenClaw native web search tool through the vulnerable input path.

AML.T0053

Authorization bypass

The misconfigured input path fails to apply the stronger policy check meant to gate restricted operations, per CWE-863 incorrect authorization.

AML.T0107

Unauthorized restricted operation

The caller executes an action that should have required higher trust/privilege, breaching the intended isolation between agent components.

Entry point

A lower-trust caller (sub-agent, plugin, or external component) invokes the OpenClaw native web search tool through the vulnerable input path.

AML.T0053

Authorization bypass

The misconfigured input path fails to apply the stronger policy check meant to gate restricted operations, per CWE-863 incorrect authorization.

AML.T0107

Unauthorized restricted operation

The caller executes an action that should have required higher trust/privilege, breaching the intended isolation between agent components.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

1 step

Upgrade OpenClaw to version 2026.6.6 or later immediately. Until patched, audit which components/callers have access to the web search tool and temporarily restrict or disable it for lower-trust agents/plugins if it can reach privileged operations. Review the vendor advisory (GHSA-v4f6-x5g5-2g4g) and the VulnCheck writeup for the exact vulnerable input path. Post-patch, add detection/logging for calls into the web search tool that originate from lower-trust callers but attempt to invoke higher-privilege operations, and periodically re-verify that trust-tier boundaries between agent components are enforced consistently across all tool entry points, not just the primary one.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

NIST AI RMF

GOVERN 1.2 - Policies, processes, and procedures addressing AI risks

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62198?

OpenClaw's native web search tool contains an incorrect-authorization flaw (CWE-863) that lets a lower-trust caller — such as a sub-agent or a lower-privilege plugin — reach code paths gated behind stronger policy checks, effectively letting it execute actions it shouldn't be authorized to perform. The CVSS score of 4.3 (network vector, low complexity, low privileges required, no user interaction, C:L/I:N/A:N) keeps the numeric severity moderate, but the real risk in agentic deployments is erosion of the trust boundary between components: any workflow that assumes the web-search tool enforces the same authorization tier as the rest of the agent is exposed. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template, so there is no evidence of active or imminent exploitation, and downstream-dependent/package-risk data for OpenClaw is currently unavailable — this reads as a hygiene fix rather than an active-exploitation emergency. Teams running OpenClaw-based agents should upgrade past version 2026.6.6 immediately and, in the interim, audit any workflow that grants the web search tool elevated scopes or chains it into privileged actions, since that is exactly the 'input path' this bug abuses.

Is CVE-2026-62198 actively exploited?

No confirmed active exploitation of CVE-2026-62198 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62198?

Upgrade OpenClaw to version 2026.6.6 or later immediately. Until patched, audit which components/callers have access to the web search tool and temporarily restrict or disable it for lower-trust agents/plugins if it can reach privileged operations. Review the vendor advisory (GHSA-v4f6-x5g5-2g4g) and the VulnCheck writeup for the exact vulnerable input path. Post-patch, add detection/logging for calls into the web search tool that originate from lower-trust callers but attempt to invoke higher-privilege operations, and periodically re-verify that trust-tier boundaries between agent components are enforced consistently across all tool entry points, not just the primary one.

What systems are affected by CVE-2026-62198?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, AI agent tool invocation pipelines.

What is the CVSS score for CVE-2026-62198?

CVE-2026-62198 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemsAI agent tool invocation pipelines

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured input paths to bypass intended authorization controls and execute restricted operations.

Exploitation Scenario

An attacker (or a compromised/malicious lower-privilege component) that only has permission to trigger the web search tool — for instance, an externally-facing sub-agent or a plugin scoped to read-only queries — crafts a request that reaches the misconfigured input path for that tool. Because the authorization check on that path doesn't correctly verify the caller's trust level, the agent processes the request as if it came from a higher-trust caller, letting the attacker trigger the restricted operation that should have required stronger policy checks — without ever holding the necessary privilege level. This effectively breaches the intended isolation between low-trust and high-trust components in the agent architecture.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.