CVE-2026-62199: Openclaw Auth Bypass Vulnerability

CVE-2026-62199 Overview

CVE-2026-62199 affects OpenClaw versions before 2026.6.6. The flaw resides in host exec environment filtering that fails to sanitize interpreter startup variables. When the affected feature is enabled and reachable over the network, a lower-trust caller can supply crafted environment variables to escalate authorization. The vulnerability is classified under [CWE-184: Incomplete List of Disallowed Inputs].

The issue allows attackers to execute or persist actions beyond their intended authorization boundary. OpenClaw is distributed as a Node.js package, expanding the potential exposure across web-facing deployments.

Critical Impact
A network-reachable attacker with low privileges can bypass authentication filtering and execute unauthorized actions on the host by injecting interpreter startup environment variables.

Affected Products

OpenClaw versions prior to 2026.6.6
OpenClaw Node.js package distribution
Deployments where the host exec environment filtering feature is enabled and network-reachable

Discovery Timeline

2026-07-13 - CVE-2026-62199 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62199

Vulnerability Analysis

The vulnerability stems from an incomplete denylist in OpenClaw's host exec environment filtering logic. When OpenClaw prepares to invoke an interpreter or child process, it filters environment variables passed from callers to prevent unsafe values from reaching the child context. The filter omits certain interpreter startup variables that influence execution behavior before user code runs.

Because the filter is incomplete, a caller with low privileges can supply environment variables that alter the interpreter's initialization. This shifts control flow into attacker-influenced paths, breaking the authorization model that OpenClaw enforces at the application layer. The result is a network-exploitable authentication and authorization bypass affecting confidentiality, integrity, and availability.

Root Cause

The root cause is an incomplete list of disallowed inputs [CWE-184] in the environment variable filter. The implementation blocks known-dangerous variables but does not enumerate all interpreter startup variables that Node.js and downstream tools honor. Any variable not present in the denylist passes through to the executed process context. This allows a caller to influence interpreter behavior at startup, before OpenClaw's own authorization checks can constrain execution.

Attack Vector

Exploitation requires network access to a reachable OpenClaw endpoint that exposes the affected feature. The attacker must hold low-privilege credentials or reach a configured input path that forwards attacker-controlled environment variables. No user interaction is required. The attacker submits a request containing crafted environment variables; OpenClaw filters the payload with the incomplete denylist and passes the residual variables to the spawned interpreter. The interpreter then acts on those variables during startup, granting the attacker execution or persistence beyond the caller's authorization scope.

Refer to the VulnCheck Advisory on Authentication Bypass and the GitHub Security Advisory for further technical details.

Detection Methods for CVE-2026-62199

Indicators of Compromise

Unexpected environment variable names appearing in OpenClaw request bodies or query parameters, particularly those beginning with NODE_, npm_, or referencing interpreter loader paths.
Child processes spawned by OpenClaw with non-standard startup arguments or module preload directives.
Authorization audit log entries showing successful actions by accounts that should not hold the corresponding permissions.

Detection Strategies

Inspect application logs for requests containing environment variable payloads referencing interpreter startup names such as NODE_OPTIONS, NODE_PATH, or loader hooks.
Correlate spawned process telemetry with the authenticated caller identity to identify privilege mismatches.
Baseline the environment variables normally passed to OpenClaw child processes and alert on deviations.

Monitoring Recommendations

Enable verbose process creation logging on hosts running OpenClaw and forward events to a centralized analytics platform.
Monitor outbound network connections from OpenClaw child processes for signs of persistence or command-and-control activity.
Track version drift across OpenClaw deployments and alert when instances remain below 2026.6.6.

How to Mitigate CVE-2026-62199

Immediate Actions Required

Upgrade OpenClaw to version 2026.6.6 or later across all deployments.
Inventory all internet-reachable OpenClaw instances and restrict network access to trusted callers only.
Rotate credentials for any low-privilege accounts that could reach the affected feature.
Review recent authorization logs for evidence of unexpected privilege escalation.

Patch Information

The maintainers released a fix in OpenClaw 2026.6.6 that closes the environment filtering gap. Details are available in the GitHub Security Advisory GHSA-hjr6-g723-hmfm. Update through the standard Node.js package manager and redeploy affected services.

Workarounds

Disable the host exec environment filtering feature if it is not required for operations.
Place OpenClaw endpoints behind an authenticated reverse proxy that strips client-supplied environment variables from incoming requests.
Enforce network segmentation so only vetted internal services can reach OpenClaw's exec-related routes.

bash

# Upgrade OpenClaw to the patched release
npm install openclaw@2026.6.6

# Verify the installed version
npm ls openclaw