PT-2026-57897

CVE-2026-62195

Published

2026-07-13

Updated

2026-07-14

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.20 through 2026.6.5

Description An authorization bypass exists in the MCP loopback feature. This issue allows lower-trust callers to execute tools reserved for the owner by utilizing configured input paths, enabling the execution or persistence of actions that exceed the caller's intended permissions.

Recommendations Update OpenClaw to version 2026.6.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Edward-X

Vendors

Affected products

Weakness enumeration

CWE-732: Incorrect Permission Assignment for Critical Resource

Related identifiers