CVE-2026-62219: OpenClaw agent hook auth bypass

CISO Take

OpenClaw's hook system fails to properly validate the allowedAgentIds allowlist when an agent ID field is submitted blank, letting a lower-trust caller or an untrusted input path slip past checks that should gate higher-privilege actions. This matters because agent orchestration frameworks like OpenClaw are increasingly the control plane connecting multiple AI agents to real tools and data — a broken authorization check here means policy enforcement can be silently skipped, not just bypassed at the edges. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this is not an active-exploitation emergency, but the attack requires only network access and low privileges with no user interaction (CVSS 7.1, AC:L/PR:L/UI:N), making it trivial to weaponize once understood. Patch to OpenClaw 2026.5.26 or later immediately; until patched, audit any code path that constructs hook requests to ensure agent IDs can never be empty/null before reaching the allowedAgentIds check, and add logging/alerting for hook invocations carrying blank or missing agent identifiers.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High-severity, low-complexity authorization bypass (CVSS 7.1, AV:N/AC:L/PR:L/UI:N) requiring only low privileges and no user interaction. The impact profile (C:L/I:H/A:N) shows the primary risk is integrity — unauthorized actions being taken under weakened authorization — rather than data destruction or availability loss. No evidence of active exploitation (not in CISA KEV), no published EPSS score, and no public exploit code or scanner template exist yet, which lowers immediate real-world exploitation likelihood. However, the vulnerability class (CWE-863, incorrect authorization) combined with a trivial bypass technique (submitting a blank value) means exploitation requires no specialized AI/ML expertise, only knowledge of the API/hook interface — so the barrier to exploitation is low even without public tooling.

How does the attack unfold?

Entry point

A lower-trust caller or a configured input path submits a request to the OpenClaw hooks system with a blank agentId field instead of a valid or disallowed identifier.

AML.T0053

Authorization bypass

The hooks allowedAgentIds validation mishandles the blank value and treats the request as authorized, exploiting the CWE-863 incorrect authorization flaw.

AML.T0107

Unauthorized action execution

The bypassed hook fires, letting the caller trigger actions or policy-sensitive operations that should have required stronger authorization from a specific agent identity.

AML.T0053

Impact

Integrity of the agent authorization model is compromised, potentially exposing limited sensitive data (C:L) and enabling unauthorized privileged actions (I:H) within the multi-agent deployment.

Entry point

A lower-trust caller or a configured input path submits a request to the OpenClaw hooks system with a blank agentId field instead of a valid or disallowed identifier.

AML.T0053

Authorization bypass

The hooks allowedAgentIds validation mishandles the blank value and treats the request as authorized, exploiting the CWE-863 incorrect authorization flaw.

AML.T0107

Unauthorized action execution

The bypassed hook fires, letting the caller trigger actions or policy-sensitive operations that should have required stronger authorization from a specific agent identity.

AML.T0053

Impact

Integrity of the agent authorization model is compromised, potentially exposing limited sensitive data (C:L) and enabling unauthorized privileged actions (I:H) within the multi-agent deployment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I High

A None

What should I do?

1 step

1) Patch OpenClaw to version 2026.5.26 or later, which fixes the allowedAgentIds validation. 2) Until patched, add input validation at the application layer to reject any hook invocation where the agent ID field is blank, null, or whitespace-only before it reaches OpenClaw's authorization check. 3) Review hook configurations to identify which hooks gate high-impact actions (e.g., write access, external calls, policy overrides) and add supplementary authorization checks outside the framework as defense-in-depth. 4) Enable/verify logging of hook invocations including the submitted agentId, and alert on any invocation with an empty or malformed agent ID — this is a strong indicator of exploitation attempts. 5) Audit any input paths (webhooks, lower-trust agent outputs) that can influence hook requests, since the advisory notes a configured input path can also trigger this, not just a direct caller.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6 - Internal organization / access control for AI system operations

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62219?

OpenClaw's hook system fails to properly validate the allowedAgentIds allowlist when an agent ID field is submitted blank, letting a lower-trust caller or an untrusted input path slip past checks that should gate higher-privilege actions. This matters because agent orchestration frameworks like OpenClaw are increasingly the control plane connecting multiple AI agents to real tools and data — a broken authorization check here means policy enforcement can be silently skipped, not just bypassed at the edges. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this is not an active-exploitation emergency, but the attack requires only network access and low privileges with no user interaction (CVSS 7.1, AC:L/PR:L/UI:N), making it trivial to weaponize once understood. Patch to OpenClaw 2026.5.26 or later immediately; until patched, audit any code path that constructs hook requests to ensure agent IDs can never be empty/null before reaching the allowedAgentIds check, and add logging/alerting for hook invocations carrying blank or missing agent identifiers.

Is CVE-2026-62219 actively exploited?

No confirmed active exploitation of CVE-2026-62219 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62219?

1) Patch OpenClaw to version 2026.5.26 or later, which fixes the allowedAgentIds validation. 2) Until patched, add input validation at the application layer to reject any hook invocation where the agent ID field is blank, null, or whitespace-only before it reaches OpenClaw's authorization check. 3) Review hook configurations to identify which hooks gate high-impact actions (e.g., write access, external calls, policy overrides) and add supplementary authorization checks outside the framework as defense-in-depth. 4) Enable/verify logging of hook invocations including the submitted agentId, and alert on any invocation with an empty or malformed agent ID — this is a strong indicator of exploitation attempts. 5) Audit any input paths (webhooks, lower-trust agent outputs) that can influence hook requests, since the advisory notes a configured input path can also trigger this, not just a direct caller.

What systems are affected by CVE-2026-62219?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI agent hooks/authorization systems.

What is the CVSS score for CVE-2026-62219?

CVE-2026-62219 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI agent hooks/authorization systems

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or policy checks.

Exploitation Scenario

An organization runs a multi-agent OpenClaw deployment where a public-facing, low-trust intake agent handles untrusted user requests and hands off qualified tasks to a higher-privilege internal agent authorized to execute sensitive actions (e.g., modifying records, calling internal APIs). The hooks system is configured so only specific agent IDs in allowedAgentIds can trigger the sensitive action hook. An attacker interacting with the low-trust intake agent — or controlling a data source the intake agent ingests — crafts a request where the agent ID field is submitted blank instead of a disallowed value. Because the validation logic mishandles blank IDs, the check passes as if the caller were authorized, and the sensitive action hook fires without the intended authorization gate, allowing the attacker to trigger privileged agent behavior they should never have been able to reach directly.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.