CVE-2026-62209

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.10-beta.1 through 2026.6.4

Description An authorization bypass exists in the ClickClack agent-mode dispatch feature. This issue allows the system to ignore the toolsAllow policy check. If the affected feature is enabled and reachable, a lower-trust caller or a configured input path can execute actions that normally require stronger authorization or policy verification.

Recommendations Update OpenClaw to version 2026.6.5 or later. As a temporary mitigation, disable the ClickClack agent-mode dispatch feature to prevent unauthorized actions.