CVE-2026-62215: OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas
OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.6.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62215?
CVE-2026-62215 has a severity rating of medium, specifically a score of 5.1.
How do I fix CVE-2026-62215?
To fix CVE-2026-62215, update OpenClaw to version 2026.6.5 or later.
What type of vulnerability is CVE-2026-62215?
CVE-2026-62215 is an authentication bypass vulnerability affecting OpenClaw.
Who is affected by CVE-2026-62215?
CVE-2026-62215 affects users of OpenClaw versions prior to 2026.6.5.
What can attackers do with CVE-2026-62215?
Attackers can exploit CVE-2026-62215 to forge trusted actions and perform unauthorized actions within the application.