PatchTheCVECVE-2026-62227: OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot ro
35
Routine
HIGH 7.7UPGRADE
CVE-2026-62227 is a high-severity flaw (CVSS 7.7) affecting openclaw. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.7 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2026-07-17 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
openclaw openclaw UPGRADE
Affected: >= 2026.4.14 and < 2026.5.26
Fixed in: 2026.5.26
Safe to downgrade to: a release before 2026.4.14
1. Check installed version
npm ls openclaw
2. UPGRADE to 2026.5.26
npm install openclaw@">=2026.5.26"
3. If no update is available yet, DOWNGRADE to a release before 2026.4.14
npm view openclaw versions
npm install openclaw@"<2026.4.14"
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-62199 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter
- CVE-2026-62203 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fa
- CVE-2026-62217 HIGH 8.8 UPGRADE OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature
- CVE-2026-62223 HIGH 8.8 UPGRADE OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature th
- CVE-2026-62192 HIGH 8.1 UPGRADE OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild acti