PatchTheCVECVE-2026-62206: OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions
32
Routine
HIGH 7.1UPGRADE
CVE-2026-62206 is a high-severity flaw (CVSS 7.1) affecting openclaw. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 72%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-07-17 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
openclaw openclaw UPGRADE
Affected: < 2026.6.9
Fixed in: 2026.6.9
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls openclaw
2. UPGRADE to 2026.6.9
npm install openclaw@">=2026.6.9"
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-62199 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter
- CVE-2026-62203 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fa
- CVE-2026-62217 HIGH 8.8 UPGRADE OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature
- CVE-2026-62223 HIGH 8.8 UPGRADE OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature th
- CVE-2026-62192 HIGH 8.1 UPGRADE OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild acti