PatchTheCVECVE-2026-62223: OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature th
40
This month
HIGH 8.8UPGRADE
CVE-2026-62223 is a high-severity flaw (CVSS 8.8) affecting openclaw. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 62%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2026-07-17 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
openclaw openclaw UPGRADE
Affected: < 2026.5.18
Fixed in: 2026.5.18
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls openclaw
2. UPGRADE to 2026.5.18
npm install openclaw@">=2026.5.18"
Exact fixes by distribution
Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source
sudo dnf upgrade --advisory=FEDORA-2026-95888f332b
Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source
sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-62199 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter
- CVE-2026-62203 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fa
- CVE-2026-62217 HIGH 8.8 UPGRADE OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature
- CVE-2026-62192 HIGH 8.1 UPGRADE OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild acti
- CVE-2026-62227 HIGH 7.7 UPGRADE OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot ro