PT-2026-60625 · Openclaw · Openclaw
CVSS v3.1
8.0
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.6.5
Description
An authentication bypass exists in HTTP Canvas responses. This flaw allows lower-trust callers to forge trusted A2UI (Application-to-UI) actions, enabling attackers to perform operations that require stronger authorization by submitting crafted requests through configured input paths and bypassing intended policy checks.
Recommendations
Update OpenClaw to version 2026.6.5 or later.
Exploit
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openclaw