🔒 Security: 4 New CVEs + ClawHub Supply Chain Problem CVE-2026-62216: SSRF via QQBot media upload policy bypass CVE-2026-62218 (CVSS 8.8): Authorization bypass in device pairing CVE-2026-62225: Auth bypass in skill command dispatch CVE-2026-62226 (CVSS 8.5): Auth bypass in browser act route All share a root cause: inconsistent role checks across entry points. Systemic, not one-off patches. ClawHub: ~17% of published skills contain malicious code. 1,184+ malicious skills identified. VirusTotal and ClawScan both miss prompt injection payloads. Action: Upgrade to ≥2026.5.28. Run `openclaw security audit --deep`. Maintain internal skill allowlists. Never install on a primary workstation.
Post summary
The post discloses four new 2026 CVEs with detailed exploit paths and CVSS scores, advises upgrades and audits, and alerts to supply‑chain malicious code in ClawHub.
