CVE-2026-62225Patch(openclaw / openclaw)

LOWCVSS 2.3 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch openclaw openclaw systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform unauthorized actions when the affected feature is enabled and reachable.

openclaw CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-07-17); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-62225

Classification over time

Date	Total	Labels

2026-07-17	1	Disclosure1
2026-07-20	1	Patch1
2026-07-27	1	Patch1

Full discourse3 posts

Kevin Kaminski@kkaminsk81d
Patch
🔒 Security: 4 New CVEs + ClawHub Supply Chain Problem CVE-2026-62216: SSRF via QQBot media upload policy bypass CVE-2026-62218 (CVSS 8.8): Authorization bypass in device pairing CVE-2026-62225: Auth bypass in skill command dispatch CVE-2026-62226 (CVSS 8.5): Auth bypass in browser act route All share a root cause: inconsistent role checks across entry points. Systemic, not one-off patches. ClawHub: ~17% of published skills contain malicious code. 1,184+ malicious skills identified. VirusTotal and ClawScan both miss prompt injection payloads. Action: Upgrade to ≥2026.5.28. Run `openclaw security audit --deep`. Maintain internal skill allowlists. Never install on a primary workstation.
Post summary
Four new CVEs with inconsistent role‑check vulnerabilities have been disclosed for ClawHub; users are urged to upgrade to version ≥2026.5.28 and run a deep security audit to mitigate the risk.
1000049
1.6K followersView on X
Kevin Kaminski@kkaminsk88d
Patch
🔒 Security roundup: CVE-2026-62225 (skill command dispatch auth bypass, affects pre-2026.5.18) — patch immediately. New from the ecosystem: SkillScan by @tokauthai scans skills pre-install, blocking HIGH/CRITICAL findings — mandatory hygiene for any org using ClawHub. tokenjuice (official plugin) compacts verbose shell output before it overwhelms agent context.
Post summary
The post urges an immediate patch for CVE‑2026‑62225, a skill command dispatch authentication bypass affecting versions before 2026.5.18, and promotes new ecosystem tools—SkillScan for hygiene checks and tokenjuice to manage shell output—to prevent exploitation.
1000066
1.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-62225 Authorization Bypass in OpenClaw Versions Before 2026.5.18 Skill Command Dispatch https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-62225
Post summary
A brief announcement of CVE-2026-62225, an authorization bypass vulnerability in OpenClaw before version 2026.5.18, linked only to a vulnerability details page.
00000149
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities