CVE-2026-62225: Openclaw Authorization Bypass Vulnerability

CVE-2026-62225 Overview

CVE-2026-62225 is an authorization bypass vulnerability affecting OpenClaw versions before 2026.5.18. The flaw resides in the skill command dispatch logic, where lower-trust callers can execute or persist actions beyond their intended authorization scope. Attackers reach the vulnerable code path through configured input channels when the affected feature is enabled and network-reachable. The issue is tracked under CWE-863: Incorrect Authorization and impacts the openclaw:openclaw Node.js package. Successful exploitation lets attackers bypass tool policy restrictions and invoke actions reserved for higher-privileged principals.

Critical Impact
Authenticated lower-trust callers can bypass tool policy enforcement in OpenClaw skill dispatch to perform unauthorized actions on confidentiality and integrity boundaries.

Affected Products

OpenClaw (Node.js package openclaw:openclaw) versions prior to 2026.5.18
Deployments where the skill command dispatch feature is enabled
Instances reachable over the network by lower-trust authenticated callers

Discovery Timeline

2026-07-17 - CVE-2026-62225 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-62225

Vulnerability Analysis

OpenClaw exposes a skill dispatch subsystem that routes commands to registered tools. The dispatcher fails to enforce the caller's authorization tier against the target skill's policy before invoking or persisting the command. As a result, a caller with low privileges can request execution of skills that policy should restrict to higher-trust principals. The vulnerability produces limited confidentiality and integrity impact on the vulnerable component, without direct effects on availability or downstream systems. Because the attack vector is network-based and requires low privileges, exploitation is feasible from any authenticated context that reaches the dispatch endpoint.

Root Cause

The root cause is missing or incomplete authorization checking within the skill command dispatch path, classified as CWE-863: Incorrect Authorization. The dispatcher trusts the caller-supplied command routing metadata rather than reconciling it against the effective policy for the resolved skill. Configured input paths accept requests that should be rejected earlier in the pipeline. This design allows a lower-trust caller to invoke privileged commands or persist state changes that the tool policy is meant to prevent.

Attack Vector

An attacker with valid low-privilege credentials sends a crafted skill dispatch request through a configured input path. The request references a command or skill that policy restricts to higher-trust roles. The dispatcher resolves and executes the command without verifying that the caller's authorization tier permits it. The action either runs immediately or is persisted for later execution, extending the attacker's reach across subsequent operations. Technical details are documented in the VulnCheck Advisory and the GitHub Security Advisory GHSA-mhm4-93fw-4qr2.

Detection Methods for CVE-2026-62225

Indicators of Compromise

Skill dispatch log entries where the caller's role does not match the invoked skill's declared authorization tier.
Unexpected persistence of skill commands originating from low-trust user contexts.
Repeated dispatch requests from a single caller enumerating skill or command identifiers.

Detection Strategies

Enable verbose audit logging on OpenClaw skill dispatch to capture caller identity, target skill, and policy decision for every invocation.
Cross-reference dispatch logs against the tool policy table to identify calls that should have been denied.
Alert on any successful invocation of privileged skills by principals whose role has not been explicitly granted access.

Monitoring Recommendations

Monitor OpenClaw application logs for HTTP requests to dispatch endpoints followed by successful execution of restricted commands.
Track version metadata on running OpenClaw instances to flag hosts still below 2026.5.18.
Baseline normal skill usage per role and alert on statistical deviations that suggest policy circumvention.

How to Mitigate CVE-2026-62225

Immediate Actions Required

Upgrade OpenClaw to version 2026.5.18 or later on all affected Node.js deployments.
Inventory all reachable OpenClaw instances and confirm whether the skill command dispatch feature is enabled.
Rotate any credentials or tokens that could have been used to invoke the dispatcher during the exposure window.
Review persisted skill commands and revoke or delete entries created by unauthorized callers.

Patch Information

The upstream fix is delivered in OpenClaw 2026.5.18, per the GitHub Security Advisory GHSA-mhm4-93fw-4qr2. Update the openclaw npm dependency to the fixed release and redeploy affected services. Validate that the dispatcher now enforces role-to-skill policy checks before executing or persisting commands.

Workarounds

Disable the skill command dispatch feature in configuration until the patched release can be deployed.
Restrict network access to the dispatcher endpoint using an authenticated reverse proxy or service mesh policy.
Tighten tool policy definitions to remove privileged skills from any role that does not require them, reducing the blast radius if dispatch is reachable.

bash

# Configuration example
npm install openclaw@">=2026.5.18"
npm ls openclaw