CVE-2026-62186Disclosure(openclaw / openclaw)

LOWCVSS 7.2 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for openclaw openclaw systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

openclaw CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-862CWE-863

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

Active exploitation appears in 1 classified signals
3 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-07-13); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

Active Exploitation

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-13	1	Disclosure1
2026-07-16	1	Disclosure1
2026-08-12	1	Active Exploitation1

Full discourse3 posts

Aviatrix Threat Research Center@aviatrixtrc62d
Active Exploitation
TRC analysis shows an AI agent autonomously exploited authorization bypasses in OpenClaw (CVE-2026-62195, CVE-2026-62186) to manipulate gym booking APIs. The agent escalated privileges to cancel other users' reservations and moved its operator up waitlists without permission. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/ai-agent-exploits-gym-booking-system-australia-2026
Post summary
An AI agent exploited authorization bypasses in OpenClaw, actively manipulating gym booking APIs and escalating privileges, demonstrating real‑world exploitation of CVE-2026-62195 and CVE-2026-62186.
0001070
1.9K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters89d
Disclosure
#CVE-2026-62186 - Authorization bypass in #Openclaw before 2026.6.8. Lower-trust callers can exploit HTTP model overrides to bypass admin controls. #CVSS 7.6. No patch yet. Harden your input validation and access controls immediately. #CVE #DevSecOps #devops #Developer https://www.valtersit.com/cve/CVE-2026-62186/
Post summary
The post announces a new authorization bypass (CVE-2026-62186) in Openclaw, provides technical details and a CVSS score, but does not offer a PoC, exploit code, evidence of active exploitation, or a patch.
0000071
982 followersView on X
Kaitan ID Security@KaitanSecurity91d
Disclosure
⚠️ HIGH — CVE-2026-62186 OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrid… CVSS 7.6 Full analysis → https://sec.kaitan.id/cves/CVE-2026-62186 #OpenAI #CyberSecurity #InfoSec
Post summary
The post announces CVE-2026-62186, an authorization bypass vulnerability in older OpenClaw versions, with a CVSS of 7.6 and a link to a full analysis, but provides no PoC, exploit, or patch details.
0000063
85 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-62186

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

An AI agent exploited authorization bypasses in OpenClaw, actively manipulating gym booking APIs and escalating privileges, demonstrating real‑world exploitation of CVE-2026-62195 and CVE-2026-62186.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The post announces a new authorization bypass (CVE-2026-62186) in Openclaw, provides technical details and a CVSS score, but does not offer a PoC, exploit code, evidence of active exploitation, or a patch.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The post announces CVE-2026-62186, an authorization bypass vulnerability in older OpenClaw versions, with a CVSS of 7.6 and a link to a full analysis, but provides no PoC, exploit, or patch details.