Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-62220: OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser

34
Routine
MEDIUM 5.3REMOTEUPGRADE

CVE-2026-62220 is a medium-severity flaw (CVSS 5.3) affecting openclaw. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

Why this priority

  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score5.3 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.5% (top 57%)
CISA exploited listNo
WeaknessCWE-307
Published2026-07-17
Last modified2026-10-23
Publisher (CNA): VulnCheck · Vendor: openclaw

Am I affected?

Timeline

openclaw openclaw UPGRADE
Affected: >= 2026.2.25 and < 2026.5.26
Fixed in: 2026.5.26
Safe to downgrade to: a release before 2026.2.25
1. Check installed version
npm ls openclaw
2. UPGRADE to 2026.5.26
npm install openclaw@">=2026.5.26"
3. If no update is available yet, DOWNGRADE to a release before 2026.2.25
npm view openclaw versions npm install openclaw@"<2026.2.25"
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs