PT-2026-57896 · Openclaw · Openclaw

Rex Liu · Publicado 2026-07-13 · Atualizado 2026-07-13 · CVE-2026-62194

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

Correção

Incorrect Permission

Missing Authorization

Enumeração de Fraquezas

CWE-732

CWE-862

Identificadores relacionados

CVE-2026-62194

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-7vrr-rp4x-4g76 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-plugin-install · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-62194 · Nota de Segurança