CVE-2026-62197 OpenClaw CVE debrief

Who should care

Users of OpenClaw before version 2026.6.6 should apply the patch to prevent potential policy bypass attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the vulnerability. The vulnerability has a medium severity level with a CVSS score of 6.3, and defenders should review and update OpenClaw configurations to ensure proper policy enforcement.

Technical summary

The vulnerability exists in the browser CDP discovery feature of OpenClaw, allowing attackers to bypass policy restrictions on WebSocket URLs. The CVSS score for this vulnerability is 6.3, indicating a medium severity level. This vulnerability may impact users of OpenClaw before version 2026.6.6. The OpenClaw policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs may allow attackers with lower-trust access to reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

Defensive priority

Apply the patch to OpenClaw as soon as possible to prevent potential policy bypass attacks. Review and update OpenClaw configurations to ensure proper policy enforcement. Monitor OpenClaw logs for potential policy bypass attempts.

Recommended defensive actions

• Apply the patch to OpenClaw version 2026.6.6 or later
• Review and update OpenClaw configurations to ensure proper policy enforcement
• Monitor OpenClaw logs for potential policy bypass attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-13T22:16:51.380Z and has not been modified since then. The NVD entry is currently Received. There is limited evidence available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The OpenClaw policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs may impact users of OpenClaw before version 2026.6.6.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.