CVE-2026-62225
Received Received - Intake

Authorization Bypass in OpenClaw Skill Command Dispatch

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: VulnCheck

Description
OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform unauthorized actions when the affected feature is enabled and reachable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-62225
EUVD
EUVD-2026-45113

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.5.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62225 is an authorization bypass vulnerability in OpenClaw versions before 2026.5.18. It allows lower-trust users to execute or persist actions beyond their intended permissions by exploiting configured input paths in the skill command dispatch feature.

Detection Guidance

To detect this vulnerability, check if your OpenClaw instance is running a version prior to 2026.5.18. Use commands like 'openclaw --version' or inspect version files in the installation directory. Verify if the skill command dispatch feature is enabled and accessible by reviewing configuration files or logs for unauthorized action attempts.

Impact Analysis

Attackers could perform unauthorized actions if the vulnerable feature is enabled and accessible. This may lead to data breaches, unauthorized modifications, or persistence of malicious actions depending on the system's configuration and operator settings.

Compliance Impact

This vulnerability could lead to unauthorized access or data manipulation, potentially violating compliance requirements for GDPR (data protection) and HIPAA (health data security). Unauthorized actions may result in data breaches or integrity violations, requiring investigation and reporting under these regulations.

Mitigation Strategies

Immediately upgrade OpenClaw to version 2026.5.18 or later. If upgrading is not possible, restrict the skill command dispatch feature to trusted operators only or disable it entirely. Review and narrow channel and tool allowlists, avoid shared Gateways between untrusted users, and disable the feature when not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62225. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart