PT-2026-57896 · Openclaw · Openclaw

Rex Liu · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-62194

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

Fix

Incorrect Permission

Missing Authorization

Weakness Enumeration

CWE-732

CWE-862

Related Identifiers

CVE-2026-62194

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-7vrr-rp4x-4g76 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-62194 · Security Note
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-plugin-install · Note