CVE-2026-62209: OpenClaw agent dispatch bypasses

CISO Take

OpenClaw's ClickClack agent-mode dispatch feature fails to enforce the toolsAllow policy check, letting a lower-trust caller or an untrusted configured input path trigger tool actions that should have required stronger authorization. This is a network-exploitable, low-complexity flaw (CVSS 8.1, AC:L, PR:L, UI:N) with high confidentiality and integrity impact — an attacker holding only low privileges could get the agent to execute tools outside its intended policy boundary, exposing sensitive data or making unauthorized changes, though availability is unaffected. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei scanner yet, and the bug is scoped to a narrow beta window (2026.5.10-beta.1 through pre-2026.6.5), so active exploitation risk is currently low — but authorization bypasses in agent tool-dispatch logic are exactly the class of bug that gets weaponized quickly once details circulate. Upgrade openclaw to 2026.6.5 or later immediately; until patched, disable or restrict the agent-mode dispatch feature and audit logs for tool invocations that should have been blocked by toolsAllow.

Sources: NVD GitHub Advisory vulncheck.com ATLAS CISA KEV

What is the risk?

High severity (CVSS 8.1) driven by network attack vector, low complexity, and no user interaction required — only low privileges are needed to trigger the flaw. The vulnerability breaks the core authorization boundary (CWE-863, Incorrect Authorization) that is supposed to gate which tools an agent can invoke, which is a high-value target class in agentic AI deployments because it directly undermines the least-privilege model the toolsAllow policy was designed to enforce. Mitigating factors: no evidence of active exploitation (not in CISA KEV), no EPSS score published, no public PoC or scanner template, and the affected version range is a pre-release beta line, which likely limits current production exposure. Overall: high technical severity, currently low observed exploitation likelihood, but should be treated as urgent given the blast radius of an agent acting outside its authorized tool scope.

How does the attack unfold?

Entry Point

A lower-trust caller or an attacker-controlled input path reaches the network-exposed, low-complexity agent-mode dispatch endpoint without needing user interaction.

AML.T0049

Authorization Bypass

The dispatch request exploits the CWE-863 flaw in ClickClack, causing the toolsAllow policy check to be skipped entirely.

AML.T0107

Unauthorized Tool Invocation

The agent executes tool actions the caller should not have been authorized to trigger, exceeding its policy-defined scope.

AML.T0053

Impact

The unauthorized action results in high-confidentiality and high-integrity impact — sensitive data exposure or unauthorized state changes — without affecting availability.

AML.T0085

Entry Point

A lower-trust caller or an attacker-controlled input path reaches the network-exposed, low-complexity agent-mode dispatch endpoint without needing user interaction.

AML.T0049

Authorization Bypass

The dispatch request exploits the CWE-863 flaw in ClickClack, causing the toolsAllow policy check to be skipped entirely.

AML.T0107

Unauthorized Tool Invocation

The agent executes tool actions the caller should not have been authorized to trigger, exceeding its policy-defined scope.

AML.T0053

Impact

The unauthorized action results in high-confidentiality and high-integrity impact — sensitive data exposure or unauthorized state changes — without affecting availability.

AML.T0085

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade OpenClaw to version 2026.6.5 or later, where the authorization bypass in ClickClack agent-mode dispatch is fixed. If immediate patching isn't possible, disable the agent-mode dispatch feature or restrict network reachability to trusted callers only, effectively removing the low-trust code path that triggers the bypass. Review toolsAllow policy configurations to confirm which tools are exposed and to which caller trust levels, and audit agent logs for tool invocations from lower-privilege or unexpected sources that occurred during the vulnerable window (2026.5.10-beta.1 through pre-2026.6.5). Monitor the GitHub Security Advisory (GHSA-wp73-f3gg-w4vr) and VulnCheck advisory for updates on exploitation activity.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

GOVERN-1.5 - Governance and oversight processes, including access control policy review

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62209?

OpenClaw's ClickClack agent-mode dispatch feature fails to enforce the toolsAllow policy check, letting a lower-trust caller or an untrusted configured input path trigger tool actions that should have required stronger authorization. This is a network-exploitable, low-complexity flaw (CVSS 8.1, AC:L, PR:L, UI:N) with high confidentiality and integrity impact — an attacker holding only low privileges could get the agent to execute tools outside its intended policy boundary, exposing sensitive data or making unauthorized changes, though availability is unaffected. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei scanner yet, and the bug is scoped to a narrow beta window (2026.5.10-beta.1 through pre-2026.6.5), so active exploitation risk is currently low — but authorization bypasses in agent tool-dispatch logic are exactly the class of bug that gets weaponized quickly once details circulate. Upgrade openclaw to 2026.6.5 or later immediately; until patched, disable or restrict the agent-mode dispatch feature and audit logs for tool invocations that should have been blocked by toolsAllow.

Is CVE-2026-62209 actively exploited?

No confirmed active exploitation of CVE-2026-62209 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62209?

Upgrade OpenClaw to version 2026.6.5 or later, where the authorization bypass in ClickClack agent-mode dispatch is fixed. If immediate patching isn't possible, disable the agent-mode dispatch feature or restrict network reachability to trusted callers only, effectively removing the low-trust code path that triggers the bypass. Review toolsAllow policy configurations to confirm which tools are exposed and to which caller trust levels, and audit agent logs for tool invocations from lower-privilege or unexpected sources that occurred during the vulnerable window (2026.5.10-beta.1 through pre-2026.6.5). Monitor the GitHub Security Advisory (GHSA-wp73-f3gg-w4vr) and VulnCheck advisory for updates on exploitation activity.

What systems are affected by CVE-2026-62209?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agent-mode tool dispatch systems.

What is the CVSS score for CVE-2026-62209?

CVE-2026-62209 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagent-mode tool dispatch systems

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN-1.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.

Exploitation Scenario

An organization runs OpenClaw with agent-mode dispatch enabled, using a toolsAllow policy to restrict which tools a lower-trust integration (e.g., a customer-facing chatbot or an automated input-processing pipeline) can invoke, while reserving sensitive tools (data export, admin actions, credential access) for higher-trust internal callers. An attacker who can reach the agent-mode dispatch endpoint — either directly as a lower-trust caller or by injecting input into a configured input path the agent consumes — crafts a dispatch request that exploits the CWE-863 authorization flaw, causing ClickClack to skip the toolsAllow check entirely. The agent then executes a tool call the attacker should never have been authorized to trigger, resulting in unauthorized data disclosure or an unauthorized state-changing action, all without needing user interaction or high privileges.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.