CVE-2026-62214

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.28

Description The Bot Framework contains an improper input validation issue where the software fails to properly validate serviceUrl parameters. This allows lower-trust callers to supply malicious values through configured input paths to retrieve sensitive authentication data, such as bot tokens and credentials, from outside the trusted boundary.

Recommendations Update to version 2026.5.28 or later. Restrict the use of the serviceUrl parameter to trusted sources until the update is applied.