CVE-2026-62200 Details

A vulnerability allowing authentication bypass through Git extension transport has been identified in OpenClaw versions prior to 2026.6.1. This issue arises from inadequate filtering in the host execution environment, which could enable lower-trust callers or configured input paths to execute or persist actions beyond their intended authorization. The vulnerability is particularly concerning when the affected feature is enabled and accessible, as it could lead to unauthorized actions depending on the operator's configuration and the reach of lower-trust input.

Users are advised to upgrade to OpenClaw version 2026.6.6 or later. Before upgrading, it is recommended to restrict the affected feature to trusted operators or disable it if not needed. As a general practice, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not required.