CVE-2026-62197: OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery

Q: What is the severity of CVE-2026-62197?

The severity of CVE-2026-62197 is rated high with a score of 8.5.

Q: How do I fix CVE-2026-62197?

To fix CVE-2026-62197, upgrade OpenClaw to version 2026.6.6 or later.

Q: What type of vulnerability is CVE-2026-62197?

CVE-2026-62197 is classified as a policy bypass vulnerability related to server-side request forgery (SSRF).

Q: What impact does CVE-2026-62197 have on users?

CVE-2026-62197 allows attackers with lower-trust access to reach blocked network destinations.

Q: When was CVE-2026-62197 published?

CVE-2026-62197 was published on July 13, 2026.

Published Jul 13, 2026

Updated

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

Affected Software

2 affected components

OpenClaw<2026.6.6

OpenClaw Openclaw Node.js<2026.6.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenClaw to a version that resolves this vulnerability.
Fixed in 2026.6.6

Event History

Jul 13, 2026

CVE Published

via MITRE·09:30 PM

Data Sourced

via MITRE·09:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-62197?

The severity of CVE-2026-62197 is rated high with a score of 8.5.

How do I fix CVE-2026-62197?

To fix CVE-2026-62197, upgrade OpenClaw to version 2026.6.6 or later.

What type of vulnerability is CVE-2026-62197?

CVE-2026-62197 is classified as a policy bypass vulnerability related to server-side request forgery (SSRF).

What impact does CVE-2026-62197 have on users?