CVE-2026-62186: OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model override
highvulnerabilityLLM-Specific
security
Summary
OpenClaw versions before 2026.6.8 have an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides (a feature that lets the system use different AI models through a standard interface). Attackers with lower trust levels can exploit misconfigured input paths to bypass admin authorization checks (security rules that verify whether a user should be allowed to do something) and run restricted operations.
Solution / Mitigation
Upgrade to OpenClaw version 2026.6.8 or later.
Vulnerability Details
CVSS Score
7.6(high)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack Vector
network
Attack Complexity
low
Privileges Required
low
User Interaction
none
Disclosure Date
July 13, 2026
Classification
Attack Type
Other
Attack SophisticationModerate
Impact (CIA+S)
confidentialityintegrity
Affected Vendors
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-62186
First tracked: July 13, 2026 at 08:07 PM
Classified by LLM (prompt v3) · confidence: 75%