CVE-2026-62195: Openclaw Authorization Bypass Vulnerability

CVE-2026-62195 Overview

CVE-2026-62195 is an authorization bypass vulnerability in OpenClaw versions 2026.5.20 before 2026.6.6. The flaw resides in the Model Context Protocol (MCP) loopback feature, which fails to enforce trust boundaries between callers. Lower-trust callers can invoke owner-only tools by routing requests through configured input paths. Attackers with limited privileges can execute or persist actions beyond their intended permission scope. The vulnerability is tracked under CWE-732: Incorrect Permission Assignment for Critical Resource and requires network access with low-level privileges to exploit.

Critical Impact
Authenticated attackers with low privileges can bypass authorization checks in the MCP loopback and invoke owner-only tools, achieving privileged action execution and persistence.

Affected Products

OpenClaw 2026.5.20 through versions prior to 2026.6.6
OpenClaw distributions running on Node.js
Deployments exposing the MCP loopback feature to lower-trust callers

Discovery Timeline

2026-07-13 - CVE-2026-62195 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62195

Vulnerability Analysis

OpenClaw exposes an MCP loopback interface that brokers tool invocations across components. The loopback trusts the transport channel rather than validating the originating caller's authorization context. This design permits a lower-trust caller to reach owner-only tools by submitting requests through paths that the loopback treats as pre-authorized.

Because the check depends on the input path rather than the caller identity, standard permission gates are skipped. The result is unauthorized tool execution with confidentiality and integrity impact on the affected component. The vulnerability requires network reachability and a low-privileged authenticated session, with no user interaction needed.

Root Cause

The root cause is incorrect permission assignment on the MCP loopback path. The loopback handler grants effective owner-level authority to any request arriving over configured input paths without re-verifying the caller's role or entitlements. Trust is implicitly derived from the transport, not from an explicit authorization decision at the tool boundary.

Attack Vector

An attacker authenticates with low-privilege credentials to an OpenClaw instance. The attacker then crafts MCP requests targeting owner-only tools and routes them through the configured loopback input path. The loopback forwards these calls as if issued by a privileged owner, executing the requested tool action. Persistence is achievable when the invoked tools modify state, register handlers, or write to configuration.

No public proof-of-concept exploit is currently listed for this issue. Refer to the VulnCheck Advisory and the GitHub Security Advisory GHSA-52xj-c9p8-78cv for technical details.

Detection Methods for CVE-2026-62195

Indicators of Compromise

MCP loopback requests invoking owner-only tools from sessions bound to non-owner accounts
Unexpected tool execution events originating from the loopback interface rather than direct owner sessions
New persistence artifacts (configuration writes, scheduled tasks, tool registrations) created by low-privileged users

Detection Strategies

Correlate MCP tool invocation logs with the authenticated principal to flag privilege mismatches
Alert on any owner-only tool executed via the loopback path where the calling session lacks owner role
Baseline expected loopback callers and treat new caller identities as high-priority anomalies

Monitoring Recommendations

Enable verbose MCP audit logging capturing caller identity, target tool, and input path
Forward OpenClaw audit logs to a centralized SIEM for correlation with authentication events
Review changes to OpenClaw configuration and tool registrations on a recurring cadence

How to Mitigate CVE-2026-62195

Immediate Actions Required

Upgrade OpenClaw to version 2026.6.6 or later, which contains the authorization fix
Restrict network exposure of the MCP loopback interface to trusted management networks only
Audit existing accounts and revoke unnecessary low-privilege access to OpenClaw instances
Review recent tool invocation and configuration change logs for signs of prior abuse

Patch Information

The vendor has published a fix in OpenClaw 2026.6.6. Details are available in the GitHub Security Advisory GHSA-52xj-c9p8-78cv. Administrators should upgrade all affected instances and verify the running version after deployment.

Workarounds

Disable the MCP loopback feature if it is not required by the deployment
Enforce network segmentation so only owner-controlled hosts can reach the loopback input path
Apply reverse-proxy authorization checks in front of OpenClaw to validate caller roles before forwarding MCP requests

bash

# Verify installed OpenClaw version and upgrade to the patched release
npm ls openclaw
npm install openclaw@2026.6.6