Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-62201OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

High 7.7

In plain English

A high-severity server-side request forgery in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies.

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	0 – before 2026.6.6

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-mgvr-6gvw-3rgr) vendor-advisory
VulnCheck Advisory: OpenClaw < 2026.6.6 Network Policy Bypass via exec-server third-party-advisory