🔒 Security: 4 New CVEs + ClawHub Supply Chain Problem CVE-2026-62216: SSRF via QQBot media upload policy bypass CVE-2026-62218 (CVSS 8.8): Authorization bypass in device pairing CVE-2026-62225: Auth bypass in skill command dispatch CVE-2026-62226 (CVSS 8.5): Auth bypass in browser act route All share a root cause: inconsistent role checks across entry points. Systemic, not one-off patches. ClawHub: ~17% of published skills contain malicious code. 1,184+ malicious skills identified. VirusTotal and ClawScan both miss prompt injection payloads. Action: Upgrade to ≥2026.5.28. Run `openclaw security audit --deep`. Maintain internal skill allowlists. Never install on a primary workstation.
Post summary
The post discloses four new 2026 CVEs involving SSRF and authorization bypasses across QQBot entry points, notes a systemic root cause, and advises upgrading to version 2026.5.28 with additional security measures.
