CVE-2026-62201: OpenClaw exec-server bypass

CISO Take

This vulnerability lets lower-trust callers inside an OpenClaw agent deployment—such as a restricted plugin or subagent—send HTTP requests through the sandbox exec-server to reach internal network destinations that OpenClaw's own policy is supposed to block. In practice this is a policy-enforcement failure (CWE-918, SSRF-class) in the component responsible for mediating network egress for agent tool calls, and it carries a high CVSS score of 7.7 driven by a network attack vector, low complexity, low privileges required, and no user interaction. There is no EPSS data, no CISA KEV listing, no public exploit, and no Nuclei template for this CVE, so there is no evidence of active or imminent mass exploitation—this is a design/implementation gap rather than a weaponized bug today. That said, any deployment running agents or plugins with intentionally lower trust levels should treat this as urgent because the entire point of the exec-server's network policy is to contain exactly this kind of lateral reach into internal infrastructure (databases, internal APIs, cloud metadata endpoints). Upgrade to OpenClaw 2026.6.6 or later immediately, and in the interim add network-layer egress controls (firewall/security groups) as a compensating control since the application-layer policy alone cannot be trusted to enforce isolation.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity (CVSS 7.7) driven by a network-reachable, low-complexity, low-privilege bypass with confidentiality impact and a scope change, meaning the exec-server component can be abused to affect resources outside its own security boundary. Exploitability signals are muted for now: no EPSS score, not in CISA KEV, no public PoC or Nuclei template identified, and no evidence of in-the-wild exploitation. However, the underlying weakness class (CWE-918, SSRF-equivalent policy bypass) is well understood and trivial to weaponize once the specific bypass technique is known, so risk should be treated as elevated for any multi-tenant or multi-trust-tier OpenClaw deployment even absent current exploit telemetry.

How does the attack unfold?

Entry point

A lower-trust plugin, subagent, or user-supplied tool with restricted network privileges invokes the OpenClaw exec-server to make an outbound HTTP request.

AML.T0053

Policy bypass

The exec-server fails to enforce its configured network policy, allowing the request to reach an internal destination that should have been blocked (CWE-918).

Impact

The attacker gains unauthorized access to internal network resources, risking disclosure of sensitive data or internal service credentials.

AML.T0086

Entry point

A lower-trust plugin, subagent, or user-supplied tool with restricted network privileges invokes the OpenClaw exec-server to make an outbound HTTP request.

AML.T0053

Policy bypass

The exec-server fails to enforce its configured network policy, allowing the request to reach an internal destination that should have been blocked (CWE-918).

Impact

The attacker gains unauthorized access to internal network resources, risking disclosure of sensitive data or internal service credentials.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I None

A None

What should I do?

1 step

Upgrade OpenClaw to version 2026.6.6 or later, which fixes the exec-server policy enforcement gap. Until patched, add network-layer (not just application-layer) egress restrictions around any host running OpenClaw's exec-server—firewall rules, security groups, or network policies that block reachability to sensitive internal destinations and cloud metadata endpoints (e.g., 169.254.169.254) regardless of what OpenClaw's own policy allows. Audit exec-server configuration to confirm which trust tiers exist and re-verify their intended network boundaries post-patch. Monitor exec-server logs/egress telemetry for requests to internal IP ranges or metadata services originating from lower-trust agent/plugin contexts, which would indicate attempted or successful bypass.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62201?

This vulnerability lets lower-trust callers inside an OpenClaw agent deployment—such as a restricted plugin or subagent—send HTTP requests through the sandbox exec-server to reach internal network destinations that OpenClaw's own policy is supposed to block. In practice this is a policy-enforcement failure (CWE-918, SSRF-class) in the component responsible for mediating network egress for agent tool calls, and it carries a high CVSS score of 7.7 driven by a network attack vector, low complexity, low privileges required, and no user interaction. There is no EPSS data, no CISA KEV listing, no public exploit, and no Nuclei template for this CVE, so there is no evidence of active or imminent mass exploitation—this is a design/implementation gap rather than a weaponized bug today. That said, any deployment running agents or plugins with intentionally lower trust levels should treat this as urgent because the entire point of the exec-server's network policy is to contain exactly this kind of lateral reach into internal infrastructure (databases, internal APIs, cloud metadata endpoints). Upgrade to OpenClaw 2026.6.6 or later immediately, and in the interim add network-layer egress controls (firewall/security groups) as a compensating control since the application-layer policy alone cannot be trusted to enforce isolation.

Is CVE-2026-62201 actively exploited?

No confirmed active exploitation of CVE-2026-62201 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62201?

Upgrade OpenClaw to version 2026.6.6 or later, which fixes the exec-server policy enforcement gap. Until patched, add network-layer (not just application-layer) egress restrictions around any host running OpenClaw's exec-server—firewall rules, security groups, or network policies that block reachability to sensitive internal destinations and cloud metadata endpoints (e.g., 169.254.169.254) regardless of what OpenClaw's own policy allows. Audit exec-server configuration to confirm which trust tiers exist and re-verify their intended network boundaries post-patch. Monitor exec-server logs/egress telemetry for requests to internal IP ranges or metadata services originating from lower-trust agent/plugin contexts, which would indicate attempted or successful bypass.

What systems are affected by CVE-2026-62201?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool execution sandboxes, multi-tenant agent deployments.

What is the CVSS score for CVE-2026-62201?

CVE-2026-62201 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/tool execution sandboxesmulti-tenant agent deployments

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies.

Exploitation Scenario

An attacker who controls or has compromised a lower-trust plugin, subagent, or user-supplied tool running within an OpenClaw-orchestrated agent stack crafts an HTTP request through the exec-server targeting an internal destination that the deployment's network policy is configured to block (e.g., an internal admin API, a database management interface, or the cloud provider's metadata service). Because the exec-server fails to properly enforce that policy for this caller, the request succeeds, and the attacker obtains data or access from a network zone that was assumed to be isolated—potentially harvesting internal credentials or pivoting further into the environment.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.