CVE-2026-62221: OpenClaw allowFrom auth bypass runs

CISO Take

OpenClaw's ClickClack feature is supposed to gate which callers can trigger which commands via an allowFrom allowlist, but an incorrect authorization check means that gate can be bypassed — a lower-trust caller or a configured input path can get the agent to execute or persist commands it was never supposed to have access to. CVSS rates this medium (5.4) because the individual confidentiality/integrity impacts are scored Low and availability is unaffected, but the practical risk in an agentic deployment is understated by that number: this is a broken access-control on the exact mechanism meant to constrain what an autonomous agent can do, so the real-world blast radius depends entirely on what commands were supposed to be off-limits. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template yet, so this is not an actively-exploited or trivially-weaponized bug today — but the low attack complexity, no user interaction, and network-reachable nature (AV:N/AC:L/UI:N) mean it's cheap to probe once the ClickClack feature is exposed. Patch to OpenClaw 2026.5.26 or later immediately, and in the meantime audit and restrict allowFrom configurations and network reachability of ClickClack, and add logging/alerting for any command execution attributed to unexpected or lower-trust callers.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

Medium severity per CVSS (5.4), but the risk profile is atypical for a 'medium' bug because the vulnerability sits directly on an authorization control for command execution within an AI agent — a class of flaw where the true impact ceiling is set by what commands are reachable, not by the CVSS sub-scores. Exploitability is favorable to an attacker: network vector, low attack complexity, no user interaction, though it does require low privileges (some existing, lower-trust access to the caller path). No EPSS data, no KEV listing, no public PoC or scanner template exist yet, so near-term mass exploitation is unlikely, but the vulnerability class (CWE-863, incorrect authorization) is well understood and straightforward to test for once an attacker has any foothold that reaches the ClickClack interface.

How does the attack unfold?

Entry via lower-trust caller

A lower-trust caller or configured input path reaches OpenClaw's network-exposed ClickClack allowFrom interface.

AML.T0049

Authorization bypass

The incorrect allowFrom check fails to properly restrict the caller, letting the request proceed as if it were authorized.

AML.T0053

Unauthorized command execution

OpenClaw executes or persists a command outside the caller's intended authorization, including commands not on the allowlist.

AML.T0050

Entry via lower-trust caller

A lower-trust caller or configured input path reaches OpenClaw's network-exposed ClickClack allowFrom interface.

AML.T0049

Authorization bypass

The incorrect allowFrom check fails to properly restrict the caller, letting the request proceed as if it were authorized.

AML.T0053

Unauthorized command execution

OpenClaw executes or persists a command outside the caller's intended authorization, including commands not on the allowlist.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

1 step

1) Patch OpenClaw to 2026.5.26 or later, which fixes the ClickClack allowFrom authorization check. 2) Until patched, restrict network exposure of the ClickClack feature (firewall/segment it from untrusted callers) or disable it if not in active use. 3) Audit existing allowFrom configurations to confirm which callers/input paths are currently trusted, and tighten scope where possible. 4) Enable/review logging of command executions triggered via ClickClack and alert on commands executed by callers outside the expected allowlist or on commands that shouldn't be reachable by a given caller tier. 5) Treat this as a defense-in-depth failure — don't rely on allowFrom alone; apply least-privilege at the OS/container level for whatever OpenClaw is permitted to execute.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6 / A.9 - AI system security and access controls

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62221?

OpenClaw's ClickClack feature is supposed to gate which callers can trigger which commands via an allowFrom allowlist, but an incorrect authorization check means that gate can be bypassed — a lower-trust caller or a configured input path can get the agent to execute or persist commands it was never supposed to have access to. CVSS rates this medium (5.4) because the individual confidentiality/integrity impacts are scored Low and availability is unaffected, but the practical risk in an agentic deployment is understated by that number: this is a broken access-control on the exact mechanism meant to constrain what an autonomous agent can do, so the real-world blast radius depends entirely on what commands were supposed to be off-limits. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template yet, so this is not an actively-exploited or trivially-weaponized bug today — but the low attack complexity, no user interaction, and network-reachable nature (AV:N/AC:L/UI:N) mean it's cheap to probe once the ClickClack feature is exposed. Patch to OpenClaw 2026.5.26 or later immediately, and in the meantime audit and restrict allowFrom configurations and network reachability of ClickClack, and add logging/alerting for any command execution attributed to unexpected or lower-trust callers.

Is CVE-2026-62221 actively exploited?

No confirmed active exploitation of CVE-2026-62221 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62221?

1) Patch OpenClaw to 2026.5.26 or later, which fixes the ClickClack allowFrom authorization check. 2) Until patched, restrict network exposure of the ClickClack feature (firewall/segment it from untrusted callers) or disable it if not in active use. 3) Audit existing allowFrom configurations to confirm which callers/input paths are currently trusted, and tighten scope where possible. 4) Enable/review logging of command executions triggered via ClickClack and alert on commands executed by callers outside the expected allowlist or on commands that shouldn't be reachable by a given caller tier. 5) Treat this as a defense-in-depth failure — don't rely on allowFrom alone; apply least-privilege at the OS/container level for whatever OpenClaw is permitted to execute.

What systems are affected by CVE-2026-62221?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool invocation, orchestration/automation pipelines.

What is the CVSS score for CVE-2026-62221?

CVE-2026-62221 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool invocationorchestration/automation pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6 / A.9

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, including running non-allowlisted commands.

Exploitation Scenario

An attacker who controls or compromises a lower-trust component in the environment — e.g., a subordinate plugin, a downstream service, or a configured input path that is only supposed to trigger a narrow set of pre-approved actions — sends a request to OpenClaw's ClickClack interface. Because the allowFrom authorization check is implemented incorrectly, the request is not properly validated against the caller's actual trust tier, and OpenClaw executes a command that was never on that caller's allowlist. Depending on what commands are reachable, this could let the attacker pivot from a narrowly-scoped, low-trust foothold into broader command execution or persistence within the agent's operating environment.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.