PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-62199 OpenClaw CVE debrief

A vulnerability in OpenClaw versions before 2026.6.6 can allow a lower-trust caller or configured input path to supply crafted environment variables, potentially leading to unauthorized actions. This flaw occurs in the host exec environment filtering and can be exploited when the affected feature is enabled and reachable. Users of OpenClaw should be aware of this vulnerability and take steps to mitigate it, including inventorying installations, enabling patched features, and restricting access to affected functionality.

Vendor
OpenClaw
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-13
Original CVE updated
2026-07-13
Advisory published
2026-07-13
Advisory updated
2026-07-13

Who should care

Users of OpenClaw versions before 2026.6.6 should be aware of this vulnerability and take steps to mitigate it. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the potential for unauthorized actions. Affected deployments should be identified and assessed for potential exposure, and compensating controls should be reviewed and implemented as needed.

Technical summary

The OpenClaw environment filtering flaw (CVE-2026-62199) occurs when the affected feature is enabled and reachable, allowing crafted environment variables to be supplied, potentially leading to unauthorized actions. This vulnerability affects OpenClaw versions before 2026.6.6 and has a CVSS score of 8.7, indicating a high severity. The flaw is related to the host exec environment filtering and can be exploited by lower-trust callers or configured input paths.

Defensive priority

High priority due to CVSS score of 8.7 and potential for unauthorized actions.

Recommended defensive actions

  • Inventory and assess OpenClaw installations for version 2026.6.6 or later
  • Enable the patched feature and restrict access to the affected functionality
  • Monitor for suspicious activity and implement compensating controls as needed
  • Apply vendor remediation when available
  • Review and implement compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; primary official records indicate a flaw in OpenClaw's environment filtering. Further investigation is needed to determine the full scope of the vulnerability. Affected product deployments should be identified and assessed for potential exposure. The CVE record and NVD detail provide additional context, but may not capture all nuances of the vulnerability. Defenders should verify OpenClaw installations and monitor for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-62199 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-62199

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-62199 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-62199

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.