PT-2026-57893 · Openclaw · Openclaw

Rex Liu · Publicado 2026-07-13 · Atualizado 2026-07-13 · CVE-2026-62191

NVD

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.

Correção

Incorrect Authorization

Missing Authorization

Enumeração de Fraquezas

CWE-863

CWE-862

Identificadores relacionados

CVE-2026-62191

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hx-r36p-f68m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-62191 · Nota de Segurança
• https://vulncheck.com/advisories/openclaw-authorization-bypass-via-message-mutations · Nota