Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck
CVE-2026-62215OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas
High 8.0
In plain English
A high-severity insufficient verification of data authenticity in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.2%top 83.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.
Affected products (as reported)
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-vr7j-7684-7gm5) vendor-advisory
- VulnCheck Advisory: OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas third-party-advisory