CVE-2026-62206: OpenClaw missing authorization

CISO Take

OpenClaw, an AI agent framework used to run Discord bots, shipped versions before 2026.6.9 with a missing authorization check (CWE-862) on its moderation action path, letting a lower-trust caller or an untrusted configured input trigger moderation actions such as kicks, bans, mutes, or message deletion that should have required a stronger policy check. The CVSS score of 7.1 reflects a network-reachable, low-complexity, low-privilege, no-user-interaction path with high integrity impact, meaning it is cheap to trigger wherever the vulnerable code path is exposed. There is no EPSS score, it is not in CISA KEV, and no public exploit or Nuclei template exists yet, so there is no evidence of active exploitation today, but the low bar to trigger it means that could change quickly once defenders and attackers read the GHSA and VulnCheck advisories. Upgrade any OpenClaw deployment to 2026.6.9 or later immediately, and in the interim audit which Discord roles or automated input paths can reach moderation-capable agent tools, add a compensating authorization gate in front of them, and alert on moderation actions originating from low-privilege accounts or automated message paths as a detection measure.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

High severity (CVSS 7.1) but not currently critical from an exploitation-likelihood standpoint: no EPSS score, no CISA KEV listing, no public exploit code, and no scanner template exist as of this writing. However, the attack requires only network access, low privileges, low complexity, and no user interaction — a favorable profile for exploitation once details circulate. Real-world risk is highly configuration-dependent: exposure hinges on whether a given OpenClaw deployment exposes the moderation action path to lower-trust callers (e.g., regular server members, bot integrations, or externally-sourced message content) versus restricting it to trusted admin roles only. Deployments that route untrusted or semi-trusted input into agent tool-invocation logic are at materially higher risk.

How does the attack unfold?

Reconnaissance

Adversary identifies an OpenClaw-powered Discord bot with moderation-capable agent tools and probes which commands or input paths reach the moderation action logic.

AML.T0084

Exploitation

A lower-trust caller or crafted input reaches the moderation action path that is missing its authorization/policy check (CWE-862) and invokes a moderation tool it should not be permitted to use.

AML.T0053

Impact

Unauthorized moderation actions execute — members are kicked, banned, or muted, or messages are deleted — disrupting the community and damaging trust in the bot's controls.

Reconnaissance

Adversary identifies an OpenClaw-powered Discord bot with moderation-capable agent tools and probes which commands or input paths reach the moderation action logic.

AML.T0084

Exploitation

A lower-trust caller or crafted input reaches the moderation action path that is missing its authorization/policy check (CWE-862) and invokes a moderation tool it should not be permitted to use.

AML.T0053

Impact

Unauthorized moderation actions execute — members are kicked, banned, or muted, or messages are deleted — disrupting the community and damaging trust in the bot's controls.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

1) Patch: upgrade OpenClaw to version 2026.6.9 or later immediately. 2) Workaround if patching is delayed: restrict which Discord roles/accounts can reach the moderation command/tool surface, and add an explicit authorization/policy check in front of moderation-capable agent tools rather than relying on OpenClaw's internal gating. 3) Review any configured input paths (webhooks, external integrations, low-trust command sources) that can reach the agent's tool-invocation logic and disable or gate them until patched. 4) Detection: monitor Discord audit logs for moderation actions (bans, kicks, mutes, message deletions) originating from accounts or paths that should not hold moderator privilege, and alert on anomalous spikes in moderation activity following the patch's public disclosure.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62206?

OpenClaw, an AI agent framework used to run Discord bots, shipped versions before 2026.6.9 with a missing authorization check (CWE-862) on its moderation action path, letting a lower-trust caller or an untrusted configured input trigger moderation actions such as kicks, bans, mutes, or message deletion that should have required a stronger policy check. The CVSS score of 7.1 reflects a network-reachable, low-complexity, low-privilege, no-user-interaction path with high integrity impact, meaning it is cheap to trigger wherever the vulnerable code path is exposed. There is no EPSS score, it is not in CISA KEV, and no public exploit or Nuclei template exists yet, so there is no evidence of active exploitation today, but the low bar to trigger it means that could change quickly once defenders and attackers read the GHSA and VulnCheck advisories. Upgrade any OpenClaw deployment to 2026.6.9 or later immediately, and in the interim audit which Discord roles or automated input paths can reach moderation-capable agent tools, add a compensating authorization gate in front of them, and alert on moderation actions originating from low-privilege accounts or automated message paths as a detection measure.

Is CVE-2026-62206 actively exploited?

No confirmed active exploitation of CVE-2026-62206 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62206?

1) Patch: upgrade OpenClaw to version 2026.6.9 or later immediately. 2) Workaround if patching is delayed: restrict which Discord roles/accounts can reach the moderation command/tool surface, and add an explicit authorization/policy check in front of moderation-capable agent tools rather than relying on OpenClaw's internal gating. 3) Review any configured input paths (webhooks, external integrations, low-trust command sources) that can reach the agent's tool-invocation logic and disable or gate them until patched. 4) Detection: monitor Discord audit logs for moderation actions (bans, kicks, mutes, message deletions) originating from accounts or paths that should not hold moderator privilege, and alert on anomalous spikes in moderation activity following the patch's public disclosure.

What systems are affected by CVE-2026-62206?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool invocation.

What is the CVSS score for CVE-2026-62206?

CVE-2026-62206 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool invocation

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

Exploitation Scenario

A community member with only standard (low-trust) Discord permissions discovers that the OpenClaw-powered moderation bot in their server accepts a command or message pattern that reaches the bot's moderation tool-invocation path without the intended authorization check. They craft a request through this reachable path — either a direct low-privilege command or a message routed through a configured input integration — that instructs the agent to kick, ban, or mute other members, or delete channel content. Because the check that should have verified moderator-level authorization is missing, the action executes as if issued by a legitimate moderator, disrupting the community, silencing specific users, or destroying message history without any actual escalation of the attacker's underlying account privileges.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.