PT-2026-60629 · Openclaw · Openclaw

Ylwango613

·

CVE-2026-62219

·

Published

2026-07-17

·

Updated

2026-07-21

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.12 through 2026.5.25
Description An authorization bypass exists in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, which allows the execution of actions that should require stronger authorization or policy checks.
Recommendations Update OpenClaw to version 2026.5.26.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-62219
GHSA-724R-V4WF-MQC5

Affected Products

Openclaw