CVE-2026-62202: OpenClaw cron isolation flaw regains

CISO Take

OpenClaw, an AI agent framework used to orchestrate autonomous LLM-driven tasks, ships an isolated cron scheduling feature meant to strip low-trust callers of dangerous execution tools — but misconfigured input path handling in versions 2026.6.1 through 2026.6.8 lets those callers claw back tools that were explicitly denied to them, effectively defeating the sandbox. With a CVSS of 8.8 (network-exploitable, low complexity, no user interaction, full confidentiality/integrity/availability impact), this is a serious authorization failure in the trust boundary that agentic AI deployments rely on to safely delegate scheduled or background work; there's no public exploit, Nuclei template, or CISA KEV listing yet, and EPSS data isn't available, so exploitation likelihood is currently unproven rather than imminent. The real risk is architectural: any organization running OpenClaw-based agents with tiered tool permissions — for example a restricted job that should only read data — must assume that boundary can be silently bypassed to reach code execution or destructive tool calls via a legitimate-looking scheduled job. Patch to 2026.6.9 or later immediately, audit existing cron job configurations for reliance on application-level tool-permission isolation rather than process-level sandboxing, and monitor for anomalous tool invocations originating from cron-triggered agent sessions that shouldn't have access to those tools.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity (CVSS 8.8) with a fully network-exploitable, low-complexity, no-user-interaction path (AV:N/AC:L/UI:N) and full C/I/A impact once triggered. The only mitigating factor is that low privileges (PR:L) are required to reach the vulnerable cron feature in the first place — this is not an unauthenticated bug, so an attacker needs at least some foothold as a low-trust caller. No public exploit, Nuclei template, or KEV listing exists today, and EPSS is unavailable, so real-world exploitation is unconfirmed. However, CWE-863 (Incorrect Authorization) issues in agent tool-permission boundaries are conceptually simple to weaponize once the GHSA advisory details are studied, so the window before a working exploit appears should be assumed short, especially for any organization exposing multi-tenant or shared OpenClaw deployments.

How does the attack unfold?

Low-privilege foothold

Attacker obtains a low-trust caller identity in OpenClaw — e.g., a restricted tenant or service account permitted to schedule isolated cron jobs but explicitly denied sensitive execution tools.

AML.T0012

Isolation bypass

Attacker crafts a cron job that exploits misconfigured input paths, causing the runtime to fail to re-apply the caller's restricted tool set.

AML.T0107

Unauthorized tool invocation

The escalated cron job gains access to and invokes previously-denied execution tools beyond its intended authorization scope.

AML.T0053

Persistence and impact

Attacker uses the regained tool access to execute arbitrary actions, exfiltrate data, or persist malicious automation, achieving full confidentiality/integrity/availability compromise.

AML.T0112.000

Low-privilege foothold

Attacker obtains a low-trust caller identity in OpenClaw — e.g., a restricted tenant or service account permitted to schedule isolated cron jobs but explicitly denied sensitive execution tools.

AML.T0012

Isolation bypass

Attacker crafts a cron job that exploits misconfigured input paths, causing the runtime to fail to re-apply the caller's restricted tool set.

AML.T0107

Unauthorized tool invocation

The escalated cron job gains access to and invokes previously-denied execution tools beyond its intended authorization scope.

AML.T0053

Persistence and impact

Attacker uses the regained tool access to execute arbitrary actions, exfiltrate data, or persist malicious automation, achieving full confidentiality/integrity/availability compromise.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade OpenClaw to 2026.6.9 or later immediately — this is the only complete fix. Until patched, audit all isolated/cron job configurations and disable or restrict any that rely on OpenClaw's own tool-permission isolation as the sole security boundary; wrap cron-triggered agent execution in process- or container-level sandboxing (e.g., separate service accounts, seccomp/namespaces) as defense-in-depth. Review logs for cron-triggered agent sessions invoking tools outside their expected/allow-listed set, and treat any such invocation as a potential compromise indicator. Track the vendor advisory (GHSA-mm9g-83wh-mhwj) and VulnCheck writeup for IOCs or exploit details as they emerge.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operational controls and access management

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62202?

OpenClaw, an AI agent framework used to orchestrate autonomous LLM-driven tasks, ships an isolated cron scheduling feature meant to strip low-trust callers of dangerous execution tools — but misconfigured input path handling in versions 2026.6.1 through 2026.6.8 lets those callers claw back tools that were explicitly denied to them, effectively defeating the sandbox. With a CVSS of 8.8 (network-exploitable, low complexity, no user interaction, full confidentiality/integrity/availability impact), this is a serious authorization failure in the trust boundary that agentic AI deployments rely on to safely delegate scheduled or background work; there's no public exploit, Nuclei template, or CISA KEV listing yet, and EPSS data isn't available, so exploitation likelihood is currently unproven rather than imminent. The real risk is architectural: any organization running OpenClaw-based agents with tiered tool permissions — for example a restricted job that should only read data — must assume that boundary can be silently bypassed to reach code execution or destructive tool calls via a legitimate-looking scheduled job. Patch to 2026.6.9 or later immediately, audit existing cron job configurations for reliance on application-level tool-permission isolation rather than process-level sandboxing, and monitor for anomalous tool invocations originating from cron-triggered agent sessions that shouldn't have access to those tools.

Is CVE-2026-62202 actively exploited?

No confirmed active exploitation of CVE-2026-62202 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62202?

Upgrade OpenClaw to 2026.6.9 or later immediately — this is the only complete fix. Until patched, audit all isolated/cron job configurations and disable or restrict any that rely on OpenClaw's own tool-permission isolation as the sole security boundary; wrap cron-triggered agent execution in process- or container-level sandboxing (e.g., separate service accounts, seccomp/namespaces) as defense-in-depth. Review logs for cron-triggered agent sessions invoking tools outside their expected/allow-listed set, and treat any such invocation as a potential compromise indicator. Track the vendor advisory (GHSA-mm9g-83wh-mhwj) and VulnCheck writeup for IOCs or exploit details as they emerge.

What systems are affected by CVE-2026-62202?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, scheduled/autonomous agent task execution.

What is the CVSS score for CVE-2026-62202?

CVE-2026-62202 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.54%.

What is the AI security impact?

Affected AI Architectures

agent frameworksscheduled/autonomous agent task execution

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in the affected cron feature.

Exploitation Scenario

An attacker holds a low-privilege identity in a shared OpenClaw deployment — for instance a tenant or service account allowed to create isolated cron jobs but explicitly denied tools like shell execution or file writes. The attacker crafts a cron job whose input path manipulates the isolation logic; when the job runs, the runtime fails to correctly re-apply the caller's restricted tool set, granting the job access to previously denied execution tools. The attacker uses this regained access to run arbitrary commands, exfiltrate data, or plant a persistent backdoor disguised as a routine scheduled automation task, blending malicious activity into normal agent operations.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.