Vulnerability Details CVE-2026-62218
OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.7%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-62218
-
cpe:2.3:a:openclaw:openclaw:2026.1.111
-
cpe:2.3:a:openclaw:openclaw:2026.1.112
-
cpe:2.3:a:openclaw:openclaw:2026.1.113
-
cpe:2.3:a:openclaw:openclaw:2026.1.122
-
cpe:2.3:a:openclaw:openclaw:2026.1.141
-
cpe:2.3:a:openclaw:openclaw:2026.1.162
-
cpe:2.3:a:openclaw:openclaw:2026.1.20
-
cpe:2.3:a:openclaw:openclaw:2026.1.20-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.20-2
-
cpe:2.3:a:openclaw:openclaw:2026.1.21
-
cpe:2.3:a:openclaw:openclaw:2026.1.21-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.21-2
-
cpe:2.3:a:openclaw:openclaw:2026.1.22
-
cpe:2.3:a:openclaw:openclaw:2026.1.23
-
cpe:2.3:a:openclaw:openclaw:2026.1.23-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.24
-
cpe:2.3:a:openclaw:openclaw:2026.1.24-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.24-2
-
cpe:2.3:a:openclaw:openclaw:2026.1.24-3
-
cpe:2.3:a:openclaw:openclaw:2026.1.241
-
cpe:2.3:a:openclaw:openclaw:2026.1.29
-
cpe:2.3:a:openclaw:openclaw:2026.1.30
-
cpe:2.3:a:openclaw:openclaw:2026.1.51
-
cpe:2.3:a:openclaw:openclaw:2026.1.52
-
cpe:2.3:a:openclaw:openclaw:2026.1.53
-
cpe:2.3:a:openclaw:openclaw:2026.2.0
-
cpe:2.3:a:openclaw:openclaw:2026.2.1
-
cpe:2.3:a:openclaw:openclaw:2026.2.12
-
cpe:2.3:a:openclaw:openclaw:2026.2.13
-
cpe:2.3:a:openclaw:openclaw:2026.2.14
-
cpe:2.3:a:openclaw:openclaw:2026.2.15
-
cpe:2.3:a:openclaw:openclaw:2026.2.17
-
cpe:2.3:a:openclaw:openclaw:2026.2.17.2
-
cpe:2.3:a:openclaw:openclaw:2026.2.19
-
cpe:2.3:a:openclaw:openclaw:2026.2.19-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.19-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.2
-
cpe:2.3:a:openclaw:openclaw:2026.2.2-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.2-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.2-3
-
cpe:2.3:a:openclaw:openclaw:2026.2.21
-
cpe:2.3:a:openclaw:openclaw:2026.2.21-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.21-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.22
-
cpe:2.3:a:openclaw:openclaw:2026.2.22-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.22-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.23
-
cpe:2.3:a:openclaw:openclaw:2026.2.24
-
cpe:2.3:a:openclaw:openclaw:2026.2.25
-
cpe:2.3:a:openclaw:openclaw:2026.2.26
-
cpe:2.3:a:openclaw:openclaw:2026.2.3
-
cpe:2.3:a:openclaw:openclaw:2026.2.3-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.6
-
cpe:2.3:a:openclaw:openclaw:2026.2.6-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.6-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.6-3
-
cpe:2.3:a:openclaw:openclaw:2026.2.61
-
cpe:2.3:a:openclaw:openclaw:2026.2.62
-
cpe:2.3:a:openclaw:openclaw:2026.2.63
-
cpe:2.3:a:openclaw:openclaw:2026.2.9
-
cpe:2.3:a:openclaw:openclaw:2026.3.1
-
cpe:2.3:a:openclaw:openclaw:2026.3.11
-
cpe:2.3:a:openclaw:openclaw:2026.3.12
-
cpe:2.3:a:openclaw:openclaw:2026.3.13
-
cpe:2.3:a:openclaw:openclaw:2026.3.2
-
cpe:2.3:a:openclaw:openclaw:2026.3.22
-
cpe:2.3:a:openclaw:openclaw:2026.3.23
-
cpe:2.3:a:openclaw:openclaw:2026.3.23-2
-
cpe:2.3:a:openclaw:openclaw:2026.3.24
-
cpe:2.3:a:openclaw:openclaw:2026.3.25
-
cpe:2.3:a:openclaw:openclaw:2026.3.28
-
cpe:2.3:a:openclaw:openclaw:2026.3.31
-
cpe:2.3:a:openclaw:openclaw:2026.3.7
-
cpe:2.3:a:openclaw:openclaw:2026.3.8
-
cpe:2.3:a:openclaw:openclaw:2026.4.1
-
cpe:2.3:a:openclaw:openclaw:2026.4.10
-
cpe:2.3:a:openclaw:openclaw:2026.4.11
-
cpe:2.3:a:openclaw:openclaw:2026.4.12
-
cpe:2.3:a:openclaw:openclaw:2026.4.14
-
cpe:2.3:a:openclaw:openclaw:2026.4.15
-
cpe:2.3:a:openclaw:openclaw:2026.4.19
-
cpe:2.3:a:openclaw:openclaw:2026.4.2
-
cpe:2.3:a:openclaw:openclaw:2026.4.20
-
cpe:2.3:a:openclaw:openclaw:2026.4.21
-
cpe:2.3:a:openclaw:openclaw:2026.4.22
-
cpe:2.3:a:openclaw:openclaw:2026.4.23
-
cpe:2.3:a:openclaw:openclaw:2026.4.24
-
cpe:2.3:a:openclaw:openclaw:2026.4.25
-
cpe:2.3:a:openclaw:openclaw:2026.4.26
-
cpe:2.3:a:openclaw:openclaw:2026.4.27
-
cpe:2.3:a:openclaw:openclaw:2026.4.29
-
cpe:2.3:a:openclaw:openclaw:2026.4.30
-
cpe:2.3:a:openclaw:openclaw:2026.4.4
-
cpe:2.3:a:openclaw:openclaw:2026.4.5
-
cpe:2.3:a:openclaw:openclaw:2026.4.7
-
cpe:2.3:a:openclaw:openclaw:2026.4.7-1
-
cpe:2.3:a:openclaw:openclaw:2026.4.8
-
cpe:2.3:a:openclaw:openclaw:2026.4.9
-
cpe:2.3:a:openclaw:openclaw:2026.5.10
-
cpe:2.3:a:openclaw:openclaw:2026.5.12
-
cpe:2.3:a:openclaw:openclaw:2026.5.14
-
cpe:2.3:a:openclaw:openclaw:2026.5.16
-
cpe:2.3:a:openclaw:openclaw:2026.5.18
-
cpe:2.3:a:openclaw:openclaw:2026.5.19
-
cpe:2.3:a:openclaw:openclaw:2026.5.2
-
cpe:2.3:a:openclaw:openclaw:2026.5.20
-
cpe:2.3:a:openclaw:openclaw:2026.5.21
-
cpe:2.3:a:openclaw:openclaw:2026.5.22
-
cpe:2.3:a:openclaw:openclaw:2026.5.23
-
cpe:2.3:a:openclaw:openclaw:2026.5.24
-
cpe:2.3:a:openclaw:openclaw:2026.5.25
-
cpe:2.3:a:openclaw:openclaw:2026.5.26
-
cpe:2.3:a:openclaw:openclaw:2026.5.3
-
cpe:2.3:a:openclaw:openclaw:2026.5.3-1
-
cpe:2.3:a:openclaw:openclaw:2026.5.4
-
cpe:2.3:a:openclaw:openclaw:2026.5.5
-
cpe:2.3:a:openclaw:openclaw:2026.5.6
-
cpe:2.3:a:openclaw:openclaw:2026.5.7
-
cpe:2.3:a:openclaw:openclaw:2026.5.9