CVE-2026-62193

Katalog CVE

CVSS 6.5 · Medium EPSS 0,32%

Kerentanan Incorrect Authorization pada openclaw. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path. The issue is fixed in 2026.6.9.

Rincian

Terbit di NVD

13 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-wgq8-x5wm-g4rw advisory vendor
• https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-plugin-install advisory pihak ketiga