Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck
CVE-2026-62219OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs
High 7.1
In plain English
A high-severity incorrect authorization in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 77.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or policy checks.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
References
- GitHub Security Advisory (GHSA-724r-v4wf-mqc5) vendor-advisory
- VulnCheck Advisory: OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs third-party-advisory