Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-62199: OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter

42
This month
HIGH 8.8UPGRADE

CVE-2026-62199 is a high-severity flaw (CVSS 8.8) affecting openclaw. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.

Why this priority

  • High severity

A fixed release or distro patch exists.

Risk facts

CVSS score8.8 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.5% (top 56%)
CISA exploited listNo
WeaknessCWE-184
Published2026-07-13
Last modified2026-10-23
Publisher (CNA): VulnCheck · Vendor: openclaw

Am I affected?

Timeline

openclaw openclaw UPGRADE
Affected: < 2026.6.6
Fixed in: 2026.6.6
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls openclaw
2. UPGRADE to 2026.6.6
npm install openclaw@">=2026.6.6"
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs