Vulnerability Details CVE-2026-62195
OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 15.3%
CVSS Severity
CVSS v3 Score 8.3
References
Products affected by CVE-2026-62195
-
cpe:2.3:a:openclaw:openclaw:2026.5.20
-
cpe:2.3:a:openclaw:openclaw:2026.5.21
-
cpe:2.3:a:openclaw:openclaw:2026.5.22
-
cpe:2.3:a:openclaw:openclaw:2026.5.23
-
cpe:2.3:a:openclaw:openclaw:2026.5.24
-
cpe:2.3:a:openclaw:openclaw:2026.5.25
-
cpe:2.3:a:openclaw:openclaw:2026.5.26
-
cpe:2.3:a:openclaw:openclaw:2026.5.27
-
cpe:2.3:a:openclaw:openclaw:2026.5.28
-
cpe:2.3:a:openclaw:openclaw:2026.5.29
-
cpe:2.3:a:openclaw:openclaw:2026.5.30
-
cpe:2.3:a:openclaw:openclaw:2026.5.31
-
cpe:2.3:a:openclaw:openclaw:2026.6.1
-
cpe:2.3:a:openclaw:openclaw:2026.6.2
-
cpe:2.3:a:openclaw:openclaw:2026.6.3
-
cpe:2.3:a:openclaw:openclaw:2026.6.4
-
cpe:2.3:a:openclaw:openclaw:2026.6.5