CVE-2026-62201: OpenClaw < 2026.6.6 Network Policy Bypass via exec-server
OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Patch 2026.6.6 Network Policy Bypass via exec-server
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62201?
CVE-2026-62201 has a medium severity rating of 4.9.
How do I fix CVE-2026-62201?
To mitigate CVE-2026-62201, upgrade OpenClaw to version 2026.6.6 or later.
What type of vulnerability is CVE-2026-62201?
CVE-2026-62201 is a network policy bypass vulnerability categorized under Server-Side Request Forgery (SSRF).
What can attackers do with CVE-2026-62201?
Attackers can exploit CVE-2026-62201 to send HTTP requests through the exec-server, accessing restricted internal network resources.
Which software is affected by CVE-2026-62201?
CVE-2026-62201 affects OpenClaw versions prior to 2026.6.6.