CVE-2026-62229 Overview
CVE-2026-62229 is an authorization bypass vulnerability in OpenClaw versions before 2026.5.18. The flaw resides in the exec allowlist glob matching logic. Lower-trust callers can craft input paths that traverse allowlist glob patterns to execute actions beyond their intended authorization scope. When the affected feature is enabled, attackers can execute or persist unauthorized actions on the target system. The issue is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and is exploitable over the network with low attack complexity.
Critical Impact
Authenticated attackers with low privileges can bypass authorization boundaries and execute unauthorized actions, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- OpenClaw versions prior to 2026.5.18
- Deployments with the exec allowlist feature enabled
- Environments allowing lower-trust callers to submit path inputs
Discovery Timeline
- 2026-07-17 - CVE-2026-62229 published to NVD
- 2026-07-18 - Last updated in NVD database
Technical Details for CVE-2026-62229
Vulnerability Analysis
The vulnerability originates in how OpenClaw evaluates exec allowlist entries using glob pattern matching. Glob patterns describe permitted execution targets but do not enforce canonical path resolution. Attackers exploit this gap by supplying paths that syntactically satisfy the glob while resolving to targets outside the intended allowlist scope.
Because the check occurs on the raw input rather than the normalized path, traversal sequences and pattern edge cases pass validation. This allows a caller with limited privileges to trigger execution or persistence actions reserved for higher-trust roles. See the GitHub Security Advisory for maintainer detail.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Glob matching alone cannot substitute for canonicalization and authorization enforcement. The allowlist trusts the pattern comparison result without verifying that the resolved path falls within the authorized set.
Attack Vector
An authenticated caller submits a specially crafted path over the network. The path is designed to match an allowed glob prefix while resolving through traversal sequences to a target outside the intended scope. The exec routine then invokes the unauthorized action under the caller's session. Additional analysis is available in the VulnCheck Authorization Bypass Advisory.
Detection Methods for CVE-2026-62229
Indicators of Compromise
- Exec invocations referencing paths containing traversal sequences such as ../ that still matched an allowlist glob.
- Actions executed by low-privilege principals against targets normally restricted to higher-trust roles.
- Unexpected persistence entries created immediately after exec API calls from authenticated but limited accounts.
Detection Strategies
- Audit exec allowlist evaluation logs and correlate matched patterns against the canonicalized target path.
- Alert on requests where the pre-normalization and post-normalization paths differ for exec operations.
- Baseline which principals invoke exec actions and flag deviations by lower-trust callers.
Monitoring Recommendations
- Ingest OpenClaw application and audit logs into a centralized analytics platform for retrospective hunting.
- Monitor for repeated allowlist match successes followed by execution of sensitive binaries or scripts.
- Track configuration changes that enable the exec feature and reassess exposure whenever the allowlist is modified.
How to Mitigate CVE-2026-62229
Immediate Actions Required
- Upgrade OpenClaw to version 2026.5.18 or later on all deployments.
- Inventory environments where the exec allowlist feature is enabled and prioritize those for patching.
- Rotate credentials for any lower-trust accounts that had access to the exec API during the exposure window.
Patch Information
Upgrade to OpenClaw 2026.5.18 or later. Patch details are published in the GitHub Security Advisory GHSA-34mr-7r3m-gfg7. Verify the fix by confirming that the upgraded build performs path canonicalization prior to allowlist matching.
Workarounds
- Disable the exec feature until patching is complete if operational requirements permit.
- Restrict allowlist glob patterns to narrow, absolute paths without wildcard segments that admit traversal.
- Limit the exec API to trusted principals through network segmentation or upstream authorization controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
