CVE-2026-62222
Received Received - Intake

OpenClaw Setup-Mode Plugin Loading Flaw

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: VulnCheck

Description
OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-62222
EUVD
EUVD-2026-45110

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.5.22 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62222 is a vulnerability in OpenClaw versions before 2026.5.22 where setup-mode discovery allows loading untrusted workspace plugins. Attackers with limited access or control over input paths can execute unauthorized actions or persist beyond their intended permissions.

Detection Guidance

To detect this vulnerability, check if OpenClaw versions prior to 2026.5.22 are installed. Run commands like 'openclaw --version' or inspect package managers for version details. Look for unusual plugin loads in setup-mode logs or workspace configurations.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code, gain unauthorized access, or maintain persistence on affected systems. The impact depends on configuration and whether lower-trust input can reach the vulnerable path. It may lead to data breaches, system compromise, or unauthorized actions.

Compliance Impact

The vulnerability could potentially violate compliance with standards like GDPR and HIPAA by enabling unauthorized execution of actions or persistence of malicious plugins. This may lead to unauthorized access to sensitive data, compromising confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade OpenClaw to version 2026.5.22 or later. Restrict setup-mode discovery to trusted operators only. Disable the feature if not needed. Review and tighten plugin allowlists and input path controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart