VULNERABILITY INTELLIGENCE

CVE-2026-62193

CVSS score6.9 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-07-13
Last modified2026-07-15
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path. The issue is fixed in 2026.6.9.

Weakness classification

  • CWE-863: Incorrect Authorization

Primary references