Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-62217: OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature

40
This month
HIGH 8.8UPGRADE

CVE-2026-62217 is a high-severity flaw (CVSS 8.8) affecting openclaw. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

Why this priority

  • High severity

A fixed release or distro patch exists.

Risk facts

CVSS score8.8 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.4% (top 62%)
CISA exploited listNo
WeaknessCWE-863
Published2026-07-17
Last modified2026-10-23
Publisher (CNA): VulnCheck · Vendor: openclaw

Am I affected?

Timeline

openclaw openclaw UPGRADE
Affected: >= 2026.5.14 and < 2026.5.27
Fixed in: 2026.5.27
Safe to downgrade to: a release before 2026.5.14
1. Check installed version
npm ls openclaw
2. UPGRADE to 2026.5.27
npm install openclaw@">=2026.5.27"
3. If no update is available yet, DOWNGRADE to a release before 2026.5.14
npm view openclaw versions npm install openclaw@"<2026.5.14"
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs