PatchTheCVEopenclaw vulnerabilities and fixes
Recent CVEs affecting openclaw, with upgrade or downgrade steps. 10 tracked.
openclaw has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-07-17. Highest priority: CVE-2026-62199 (score 42/100).
- CVE-2026-62199 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter
- CVE-2026-62203 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fa
- CVE-2026-62217 HIGH 8.8 UPGRADE OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature
- CVE-2026-62223 HIGH 8.8 UPGRADE OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature th
- CVE-2026-62192 HIGH 8.1 UPGRADE OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild acti
- CVE-2026-62227 HIGH 7.7 UPGRADE OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot ro
- CVE-2026-62220 MEDIUM 5.3 UPGRADE OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser
- CVE-2026-62186 HIGH 7.6 UPGRADE OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP mode
- CVE-2026-62206 HIGH 7.1 UPGRADE OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions
- CVE-2026-53844 MEDIUM 6.5 UPGRADE OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search tha
FAQ
How do I fix openclaw vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openclaw being exploited right now?
None of the tracked openclaw CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openclaw CVE should I patch first?
CVE-2026-62199 currently ranks highest (42/100): OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter .