CVE-2026-62223 Details
Description
OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable.
An authorization bypass vulnerability has been identified in OpenClaw versions prior to 2026.5.18, specifically within the device-pair approval feature. This vulnerability allows lower-trust callers to perform actions beyond their authorized limits. Exploitation can occur through misconfigured input paths, enabling unauthorized actions to be executed or persisted when the feature is active and accessible.
Users are advised to upgrade to OpenClaw version 2026.5.18 or later. Before upgrading, it is recommended to restrict the device-pair approval feature to trusted operators or disable it if not needed. As a general practice, maintain narrow channel and tool allowlists, avoid sharing a single Gateway between untrusted users, and disable the feature when it is unnecessary.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openclaw/openclaw/security/advisories/GHSA-hx85-fgcw-9vrc | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-device-pair | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.5.18 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | Initial Analysis | [email protected] |
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |