{"data":{"id":"c90f687e-a6ee-4714-a742-9907c8f136b2","title":"CVE-2026-62186: OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model…","summary":"CVE-2026-62186 is an authorization bypass in OpenClaw versions before 2026.6.8, located in OpenAI-compatible HTTP model overrides. Lower-trust callers can use misconfigured input paths to perform actions that require stronger authorization checks, including restricted operations that admin authorization policies should block. VulnCheck rates it CVSS 4.0 7.2 (High), with a vector of AV:N/AC:L/AT:N/PR:L/UI:N, and NIST has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62186","publishedAt":"2026-07-13T22:16:49.607Z","cveId":"CVE-2026-62186","cweIds":["CWE-862","CWE-863"],"cvssScore":"7.6","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"OpenClaw authorization bypass via OpenAI-compatible HTTP model overrides","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00328,"epssCheckedAt":"2026-10-14T18:05:58.202Z","kevDateAdded":null,"advisoryAliases":["GHSA-qhh8-mfpm-5j6c"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:48.002Z","patchAvailable":null,"disclosureDate":"2026-07-13T22:16:49.607Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}