CVE-2026-62209: Openclaw Authorization Bypass Vulnerability

CVE-2026-62209 Overview

CVE-2026-62209 is an authorization bypass vulnerability in OpenClaw, a Node.js-based project, affecting versions 2026.5.10-beta.1 through versions prior to 2026.6.5. The flaw resides in the ClickClack agent-mode dispatch feature, which fails to enforce the toolsAllow policy check. When the affected feature is enabled and reachable over the network, a lower-trust caller or configured input path can perform actions that should require stronger authorization. The vulnerability is categorized under [CWE-863: Incorrect Authorization].

Critical Impact
A network-adjacent, low-privileged attacker can bypass the toolsAllow policy in ClickClack agent-mode dispatch to invoke actions restricted to higher-privileged callers, compromising confidentiality and integrity.

Affected Products

OpenClaw 2026.5.10-beta.1 (Node.js distribution)
OpenClaw versions after 2026.5.10-beta.1 and before 2026.6.5
Deployments where the ClickClack agent-mode dispatch feature is enabled and reachable

Discovery Timeline

2026-07-17 - CVE-2026-62209 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-62209

Vulnerability Analysis

The vulnerability exists in the ClickClack agent-mode dispatch code path within OpenClaw. This dispatch feature is intended to route requests to tools or agents based on a configured allow-list called toolsAllow. The policy check for toolsAllow is not applied on the affected path, allowing callers to reach dispatch targets that should be gated. The result is that actions requiring elevated authorization become available to callers holding only lower-trust credentials or reachable via configured input paths. Because dispatch operations can invoke tools that read or modify data, both confidentiality and integrity of the host application are affected. The flaw does not directly enable denial of service, and impact is scoped to the OpenClaw instance rather than downstream systems.

Root Cause

The root cause is a missing or bypassed authorization check ([CWE-863]) in the agent-mode dispatch handler. The toolsAllow policy is defined but the dispatch path does not consult it before invoking the requested tool, breaking the authorization contract between callers and the tool invocation layer.

Attack Vector

Exploitation occurs over the network against an OpenClaw instance where ClickClack agent-mode dispatch is enabled and reachable. The attacker must possess low privileges within the application and rely on a passive precondition, such as a specific configuration or input path. No user interaction is required. After connecting, the attacker crafts a dispatch request targeting a tool that should be gated by toolsAllow. Because the check is skipped, the dispatcher executes the requested action, returning results or side effects that the caller should not be authorized to trigger.

No public proof-of-concept exploit is available at the time of publication. Technical detail is documented in the GitHub Security Advisory GHSA-wp73-f3gg-w4vr and the VulnCheck Advisory on OpenClaw.

Detection Methods for CVE-2026-62209

Indicators of Compromise

Dispatch invocations in OpenClaw application logs referencing tools not present in the configured toolsAllow list.
Requests to the ClickClack agent-mode dispatch endpoint originating from lower-trust accounts or unexpected source addresses.
Tool execution events immediately following authentication as a limited-privilege user, with no corresponding policy evaluation entry.

Detection Strategies

Enable verbose authorization logging on the ClickClack dispatch path and alert when tool invocations occur without a preceding toolsAllow policy evaluation record.
Compare the set of tools actually invoked against the configured allow-list, flagging any invocation outside the allow-list.
Correlate low-privilege session identifiers with high-impact tool invocations to identify authorization mismatches.

Monitoring Recommendations

Track version metadata of running OpenClaw deployments and alert on any instance in the vulnerable 2026.5.10-beta.1 through pre-2026.6.5 range.
Monitor network telemetry for external reachability of the agent-mode dispatch endpoint and restrict exposure to trusted management networks.
Forward OpenClaw application logs to a central log platform for retention and behavioral analytics on tool invocation patterns.

How to Mitigate CVE-2026-62209

Immediate Actions Required

Upgrade OpenClaw to version 2026.6.5 or later on all deployed instances, prioritizing internet-reachable systems.
If upgrade is not immediately possible, disable the ClickClack agent-mode dispatch feature until patching is complete.
Audit recent dispatch and tool-invocation logs for evidence of unauthorized tool usage by lower-trust callers.

Patch Information

The fix is delivered in OpenClaw 2026.6.5. Refer to the GitHub Security Advisory GHSA-wp73-f3gg-w4vr for release details and the VulnCheck Advisory on OpenClaw for supplementary analysis.

Workarounds

Disable agent-mode dispatch in the ClickClack configuration until the patched version is deployed.
Restrict network access to the OpenClaw service using firewall rules or a reverse proxy so only trusted administrators can reach dispatch endpoints.
Reduce the size of the toolsAllow policy scope and remove any high-impact tools that are not strictly required, limiting the blast radius if the check is bypassed.
Rotate credentials for any lower-trust accounts that could reach the vulnerable endpoint prior to patching.

bash

# Upgrade OpenClaw via npm to the fixed release
npm install openclaw@2026.6.5

# Verify installed version
npm ls openclaw