CVE-2026-62221

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.12 through 2026.5.25

Description An incorrect authorization issue exists in the ClickClack allowFrom feature. When this feature is enabled and accessible, a lower-trust caller or a configured input path can execute or persist actions that exceed the intended authorization levels, which may include the execution of commands not included in the allowlist.

Recommendations Update OpenClaw to version 2026.5.26. As a temporary mitigation, disable the allowFrom feature within ClickClack to prevent unauthorized command execution.