Vulnerabilities CVE-2026-62195

CVE-2026-62195

High

Open

TLP:CLEAR

OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.

Details

CVSS Score: 8.7
EPSS Score ⓘ: 0.23%

14.1th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Confidence: 90%
Published: Jul 13, 2026
Last Modified: Jul 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.