Dashboard / CVE-2026-62215

CVE-2026-62215

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 60/100
Published: 2026-07-17 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Active
S: X
AT: None
VC: None
VI: None
VA: None

Description

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
openclaw openclaw < 2026.6.5

References & Advisories (2)

Bug Bounty Relevance

60 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.25%
Raw Score 0.002500
Percentile 16.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00250
2026-10-28
0.00250

Intelligence Sources

nvd ref →

External Links