CVE-2026-62199 — OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering
OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachab…
Published: 2026-07-13 · CVSS: 8.7 · CVSS 4.0
OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7