CVE-2026-62215: OpenClaw auth bypass forges trusted

CISO Take

OpenClaw versions before 2026.6.5 contain an authentication bypass in HTTP Canvas responses that lets a lower-trust caller forge A2UI actions normally gated behind stronger authorization, effectively sidestepping the framework's policy checks. This matters because OpenClaw is an agent framework: a successful forgery lets an attacker make the agent execute privileged actions on its behalf, and the CVSS 8.0 vector (scope changed, high confidentiality and integrity impact) confirms the blast radius extends beyond the vulnerable component itself. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template available yet, so this is not under active mass exploitation, but the high attack complexity combined with required user interaction points to a targeted, crafted-request attack rather than opportunistic scanning. Teams running OpenClaw should upgrade to 2026.6.5 or later immediately, audit any configured input paths for exposure to lower-trust callers, and add detection for A2UI action requests whose authorization level doesn't match the requesting caller.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

High severity (CVSS 8.0) but currently lower urgency for exploitation: no EPSS data, not in CISA KEV, no public PoC or scanner template exists. The high attack complexity (AC:H) and requirement for user interaction (UI:R) raise the bar for exploitation, but the scope-changed, high-confidentiality/high-integrity impact means a successful exploit gives the attacker meaningful control over agent-authorized actions. Risk should be treated as elevated-but-not-emergent: patch on normal high-severity SLA, not an emergency out-of-band response, unless the deployment exposes OpenClaw's canvas/input paths directly to untrusted or multi-tenant callers.

How does the attack unfold?

Initial Access

Attacker obtains low-trust access to a configured HTTP Canvas input path exposed by the OpenClaw agent deployment.

AML.T0049

Forgery

Attacker crafts a request that forges a trusted A2UI action, relying on a victim's interaction to trigger the malicious canvas response.

AML.T0107

Impact

The agent executes the forged action as if it came from a higher-trust caller, breaching intended confidentiality and integrity boundaries.

AML.T0053

Initial Access

Attacker obtains low-trust access to a configured HTTP Canvas input path exposed by the OpenClaw agent deployment.

AML.T0049

Forgery

Attacker crafts a request that forges a trusted A2UI action, relying on a victim's interaction to trigger the malicious canvas response.

AML.T0107

Impact

The agent executes the forged action as if it came from a higher-trust caller, breaching intended confidentiality and integrity boundaries.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.0 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Changed

C High

I High

A None

What should I do?

1 step

Upgrade OpenClaw to version 2026.6.5 or later, which fixes the authentication bypass per the GitHub Security Advisory (GHSA-vr7j-7684-7gm5). Until patched, review and restrict which callers can reach configured HTTP Canvas input paths, and avoid exposing those paths to untrusted or lower-trust user tiers. Audit A2UI action logs for requests where the acting caller's trust level doesn't match the privilege level of the action performed. Confirm the fix by re-testing that lower-trust callers cannot forge or trigger actions reserved for higher-trust roles after upgrading.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62215?

OpenClaw versions before 2026.6.5 contain an authentication bypass in HTTP Canvas responses that lets a lower-trust caller forge A2UI actions normally gated behind stronger authorization, effectively sidestepping the framework's policy checks. This matters because OpenClaw is an agent framework: a successful forgery lets an attacker make the agent execute privileged actions on its behalf, and the CVSS 8.0 vector (scope changed, high confidentiality and integrity impact) confirms the blast radius extends beyond the vulnerable component itself. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template available yet, so this is not under active mass exploitation, but the high attack complexity combined with required user interaction points to a targeted, crafted-request attack rather than opportunistic scanning. Teams running OpenClaw should upgrade to 2026.6.5 or later immediately, audit any configured input paths for exposure to lower-trust callers, and add detection for A2UI action requests whose authorization level doesn't match the requesting caller.

Is CVE-2026-62215 actively exploited?

No confirmed active exploitation of CVE-2026-62215 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62215?

Upgrade OpenClaw to version 2026.6.5 or later, which fixes the authentication bypass per the GitHub Security Advisory (GHSA-vr7j-7684-7gm5). Until patched, review and restrict which callers can reach configured HTTP Canvas input paths, and avoid exposing those paths to untrusted or lower-trust user tiers. Audit A2UI action logs for requests where the acting caller's trust level doesn't match the privilege level of the action performed. Confirm the fix by re-testing that lower-trust callers cannot forge or trigger actions reserved for higher-trust roles after upgrading.

What systems are affected by CVE-2026-62215?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic UI / A2UI interfaces.

What is the CVSS score for CVE-2026-62215?

CVE-2026-62215 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic UI / A2UI interfaces

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

Exploitation Scenario

An attacker with low-trust access to an OpenClaw-based agent deployment — for example, a standard user in a multi-tenant agent platform — identifies a configured HTTP Canvas input path that renders interactive A2UI elements. By crafting a request through that path that mimics the structure of a trusted, higher-authorization action, the attacker tricks the policy check into treating the forged request as legitimate. Because user interaction is required, the attacker likely needs to lure a user (or another privileged component) into loading a canvas response containing the crafted forgery, after which the agent executes an action — such as a sensitive data read or a state-changing operation — that should have been restricted to a higher-trust caller.

Weaknesses (CWE)

CWE-345 Insufficient Verification of Data Authenticity Primary CWE-345 Insufficient Verification of Data Authenticity

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.