CVE-2026-62193
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
OpenClaw versions 2026.6.5 through 2026.6.8 contain a vulnerability in the plugin installation wrappers that can bypass the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.
Risk Assessment
The risk involves unauthorized installation or modification of plugins, potentially leading to privilege escalation, arbitrary code execution, or persistent system configuration changes. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path.
Recommendation
Immediately upgrade OpenClaw to version 2026.6.9 or later. If upgrading is not possible, disable the plugin installation feature or restrict access to trusted entities only.
Other vulnerabilities in OpenClaw
See all- CVE-2026-45006High
OpenClaw before version 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations, allowing compromised models to write unsafe configuration changes by bypassing an incomplete denylist protection.
- CVE-2026-45004High
OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository.
- CVE-2026-45001High
OpenClaw before version 2026.4.20 contains a guard bypass vulnerability in the config.patch and config.apply endpoints. This vulnerability fails to protect operator-trusted settings such as sandbox policy, plugin enablement, gateway auth/TLS, and MCP server configuration.
- CVE-2026-44995High
OpenClaw before version 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup variables to MCP server processes.
- CVE-2026-44118High
OpenClaw before version 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations.
- CVE-2026-44115High
OpenClaw before version 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.
- CVE-2026-44114High
OpenClaw before version 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like OPENCLAW_GIT_DIR to manipulate trusted OpenClaw runtime behavior during source-update or installer flows.
- CVE-2026-44110High
OpenClaw before version 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization. Attackers with DM-paired sender IDs can execute room control commands without being in configured allowlists.
- CVE-2026-43585High
OpenClaw before version 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request.
- CVE-2026-43584High
OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy. Attackers can manipulate these environment variables to influence execution behavior and network connectivity.
Original NVD description (English source)
OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path. The issue is fixed in 2026.6.9.