CVE-2026-62226: OpenClaw auth bypass

CISO Take

OpenClaw's browser "act" route fails to validate which tab an action is actually targeting, so an attacker with only low-trust access — or content reaching the agent through a configured input path — can trigger actions that should require stronger authorization or policy approval. This is a CVSS 8.5 network-exploitable flaw with low attack complexity, no user interaction, and low privileges required, and it hits confidentiality hard (C:H) while allowing limited integrity impact (I:L), which matters because OpenClaw is a browser-automation AI agent that routinely holds authenticated sessions to internal tools, email, or SaaS admin panels. There's no CISA KEV listing, no public exploit code, and no EPSS score yet, so this looks pre-weaponized rather than actively exploited — but the bug class (authorization scoped to the wrong tab/context) is exactly the kind of policy-check gap that indirect prompt injection and AI Agent Clickbait techniques are built to abuse. Patch to OpenClaw 2026.5.19 or later immediately; until then, restrict which tabs/domains the agent is permitted to operate on via network-level allowlisting and review agent action logs for cross-tab or cross-session activity that shouldn't have been authorized.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High risk (CVSS 8.5) driven by network attack vector, low complexity, no user interaction, and a confidentiality-high impact — but tempered by the absence of KEV listing, public exploit code, or a Nuclei template, and by EPSS being unscored. The real risk driver is architectural: this is an authorization/policy-check flaw inside an autonomous browser agent, not a passive library bug, so successful exploitation directly translates into unauthorized agent actions against sessions the attacker shouldn't be able to touch. Organizations running OpenClaw against authenticated browser sessions (internal dashboards, ticketing, email, cloud consoles) carry the highest exposure; the lack of downstream dependent data and package risk score (0/100, likely uninstrumented rather than genuinely zero-risk) means blast radius can't be quantified from telemetry alone and should be assumed broad given OpenClaw's agentic use case.

How does the attack unfold?

Low-trust access

Attacker obtains lower-trust access to the agent or reaches it via a configured input path (e.g., content the agent processes or a limited-privilege account).

AML.T0012

Authorization bypass

The browser act route fails to validate the current-tab URL, letting the attacker's request be misattributed to a higher-trust tab or context.

AML.T0107

Unauthorized action invocation

The agent executes a browser action that should have required stronger authorization or policy approval, on behalf of the attacker.

AML.T0053

Confidentiality impact

Sensitive data or state from the higher-trust session is exposed or manipulated, consistent with the CVSS confidentiality-high, integrity-low impact rating.

AML.T0085

Low-trust access

Attacker obtains lower-trust access to the agent or reaches it via a configured input path (e.g., content the agent processes or a limited-privilege account).

AML.T0012

Authorization bypass

The browser act route fails to validate the current-tab URL, letting the attacker's request be misattributed to a higher-trust tab or context.

AML.T0107

Unauthorized action invocation

The agent executes a browser action that should have required stronger authorization or policy approval, on behalf of the attacker.

AML.T0053

Confidentiality impact

Sensitive data or state from the higher-trust session is exposed or manipulated, consistent with the CVSS confidentiality-high, integrity-low impact rating.

AML.T0085

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I Low

A None

What should I do?

1 step

1) Patch OpenClaw to version 2026.5.19 or later immediately — this is the primary fix per the vendor advisory. 2) Until patched, avoid running OpenClaw agents with simultaneous access to both low-trust (e.g., public web browsing) and high-trust (e.g., authenticated internal) tabs/sessions in the same agent context — isolate sessions by trust tier. 3) Restrict configured input paths that feed the agent (e.g., untrusted web content, third-party data) so they cannot indirectly trigger the browser act route. 4) Review agent action/audit logs for actions executed against tabs or domains outside the expected policy scope for a given task. 5) Apply network-level egress controls or domain allowlisting for agent-driven browser sessions as defense-in-depth against unauthorized cross-tab actions.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent AML.T0053 - AI Agent Tool Invocation AML.T0100 - AI Agent Clickbait AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MANAGE-2.3 - Mechanisms for handling AI system unauthorized behavior

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62226?

OpenClaw's browser "act" route fails to validate which tab an action is actually targeting, so an attacker with only low-trust access — or content reaching the agent through a configured input path — can trigger actions that should require stronger authorization or policy approval. This is a CVSS 8.5 network-exploitable flaw with low attack complexity, no user interaction, and low privileges required, and it hits confidentiality hard (C:H) while allowing limited integrity impact (I:L), which matters because OpenClaw is a browser-automation AI agent that routinely holds authenticated sessions to internal tools, email, or SaaS admin panels. There's no CISA KEV listing, no public exploit code, and no EPSS score yet, so this looks pre-weaponized rather than actively exploited — but the bug class (authorization scoped to the wrong tab/context) is exactly the kind of policy-check gap that indirect prompt injection and AI Agent Clickbait techniques are built to abuse. Patch to OpenClaw 2026.5.19 or later immediately; until then, restrict which tabs/domains the agent is permitted to operate on via network-level allowlisting and review agent action logs for cross-tab or cross-session activity that shouldn't have been authorized.

Is CVE-2026-62226 actively exploited?

No confirmed active exploitation of CVE-2026-62226 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62226?

1) Patch OpenClaw to version 2026.5.19 or later immediately — this is the primary fix per the vendor advisory. 2) Until patched, avoid running OpenClaw agents with simultaneous access to both low-trust (e.g., public web browsing) and high-trust (e.g., authenticated internal) tabs/sessions in the same agent context — isolate sessions by trust tier. 3) Restrict configured input paths that feed the agent (e.g., untrusted web content, third-party data) so they cannot indirectly trigger the browser act route. 4) Review agent action/audit logs for actions executed against tabs or domains outside the expected policy scope for a given task. 5) Apply network-level egress controls or domain allowlisting for agent-driven browser sessions as defense-in-depth against unauthorized cross-tab actions.

What systems are affected by CVE-2026-62226?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation / computer-use agents, RPA-style AI workflows.

What is the CVSS score for CVE-2026-62226?

CVE-2026-62226 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation / computer-use agentsRPA-style AI workflows

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0100 AI Agent Clickbait

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.

Exploitation Scenario

An organization deploys OpenClaw as a browser-automation agent that has one tab open to a low-trust source (e.g., a public webpage or a configured low-privilege input feed) and another tab authenticated to an internal admin console. An attacker who only has access to the low-trust input path — for example, by controlling content the agent is instructed to read or interact with — crafts a request that the browser act route fails to properly bind to the correct (low-trust) tab. Because the current-tab URL check isn't validated, the agent executes the action against the higher-trust admin tab instead, performing a privileged action (e.g., a settings change, a data read from an authenticated session) that should have required explicit stronger authorization. The attacker never directly authenticates to the sensitive system — they route through the agent's own session, exploiting the authorization gap in tab validation.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.