CVE-2026-62201: Openclaw Auth Bypass Vulnerability

CVE-2026-62201 Overview

CVE-2026-62201 is a network policy bypass vulnerability affecting OpenClaw versions before 2026.6.6. The flaw resides in the sandbox exec-server component, which fails to enforce configured network policies against lower-trust callers. Attackers with limited privileges can send HTTP requests through the exec-server to reach internal network destinations that policy should have blocked. The issue is classified as Server-Side Request Forgery (SSRF) under CWE-918. The vulnerability affects the OpenClaw Node.js package distributed by the upstream openclaw/openclaw project.

Critical Impact
Authenticated low-privilege attackers can bypass sandbox network restrictions and reach internal-only network resources via the exec-server HTTP proxy path.

Affected Products

OpenClaw (openclaw:openclaw) Node.js package versions prior to 2026.6.6
Deployments exposing the sandbox exec-server component to lower-trust callers
Environments relying on OpenClaw network policy enforcement to restrict internal reachability

Discovery Timeline

2026-07-17 - CVE-2026-62201 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-62201

Vulnerability Analysis

OpenClaw provides a sandbox execution environment with a companion exec-server component that brokers actions on behalf of callers. Administrators configure network policies to restrict which destinations sandboxed workloads may reach. In vulnerable releases, the exec-server accepts HTTP requests from lower-trust callers and forwards them to arbitrary network destinations without applying the same policy checks enforced elsewhere.

The result is a classic Server-Side Request Forgery condition. A caller that is only authorized for public or restricted access can pivot through the exec-server to reach internal services, metadata endpoints, or other blocked destinations. The attack requires network reachability to the exec-server and low-level credentials but no user interaction.

The attack does not affect confidentiality, integrity, or availability of the OpenClaw process itself. Impact instead falls on the surrounding subsequent system, where reachable internal services become exposed to unauthorized requests.

Root Cause

The root cause is missing policy enforcement on the request path handled by the exec-server. Network policy checks that apply to direct sandbox egress are not applied when requests transit the exec-server HTTP interface. This inconsistency allows callers to bypass the policy layer by choosing the exec-server as the request originator.

Attack Vector

An attacker authenticates or otherwise gains low-privilege access to a system that can reach the exec-server. The attacker then issues HTTP requests through the exec-server targeting internal hostnames, IP addresses, or cloud metadata endpoints that policy would normally block. Because the exec-server performs the outbound request in its own trust context, the destination server observes a request from a trusted source and responds normally.

No verified exploitation code has been published. Technical details are documented in the GitHub Security Advisory GHSA-mgvr-6gvw-3rgr and the VulnCheck advisory.

Detection Methods for CVE-2026-62201

Indicators of Compromise

Outbound HTTP requests originating from the exec-server process to internal RFC1918 ranges, link-local addresses (169.254.169.254), or other destinations not expected from that component
Access logs on internal services showing requests sourced from the OpenClaw exec-server host that do not match legitimate workflows
Unexpected DNS lookups for internal-only hostnames from the OpenClaw host

Detection Strategies

Correlate exec-server request logs against the configured OpenClaw network policy to identify calls that should have been blocked
Baseline expected destinations for the exec-server and alert on deviations, particularly requests to cloud metadata IPs or internal management interfaces
Inspect authentication logs for low-privilege accounts issuing high volumes of exec-server HTTP requests

Monitoring Recommendations

Enable verbose request logging on the exec-server and forward events to a centralized analytics platform for retention and correlation
Add network-layer detections at egress points to flag traffic from OpenClaw hosts to internal-only CIDR ranges
Review CWE-918 SSRF detection content in existing SIEM rulesets and extend coverage to OpenClaw request patterns

How to Mitigate CVE-2026-62201

Immediate Actions Required

Upgrade OpenClaw to version 2026.6.6 or later, which restores policy enforcement on the exec-server request path
Inventory all OpenClaw deployments and confirm the running version against the fixed release
Restrict network reachability to the exec-server so only trusted callers can issue requests
Rotate any secrets that may have been exposed through internal endpoints reachable via the bypass

Patch Information

The vendor released the fix in OpenClaw 2026.6.6. Upgrade instructions and patch metadata are published in the OpenClaw GitHub Security Advisory. Node.js users should update the openclaw package via their standard package manager and redeploy affected services.

Workarounds

Place network-layer egress controls in front of the OpenClaw host to block traffic to sensitive internal ranges until the patch is deployed
Terminate or firewall the exec-server listener from lower-trust network segments if upgrade is not immediately feasible
Require an authenticated allowlist of destinations at the proxy layer for any environment that must keep the exec-server reachable

bash

# Upgrade the OpenClaw Node.js package to the fixed release
npm install openclaw@2026.6.6

# Verify the installed version
npm ls openclaw