CVE-2026-62199: OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering
OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.6.6 - Compensating control
If the affected environment-filtering feature is enabled and the host interface is reachable, restrict access so lower-trust callers cannot reach it (e.g., limit network access/ACLs to trusted clients only).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62199?
CVE-2026-62199 has a severity rating of high at 8.8.
What kind of vulnerability is CVE-2026-62199?
CVE-2026-62199 is an authentication bypass vulnerability in OpenClaw due to improper environment filtering.
How do I fix CVE-2026-62199?
To fix CVE-2026-62199, upgrade OpenClaw to version 2026.6.6 or later.
What systems are affected by CVE-2026-62199?
CVE-2026-62199 affects all versions of OpenClaw prior to 2026.6.6.
What are the potential consequences of exploiting CVE-2026-62199?
Exploiting CVE-2026-62199 could allow an attacker to bypass authentication and execute actions with elevated privileges.