Vulnerability Details CVE-2026-62219
OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or policy checks.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 8.1%
CVSS Severity
CVSS v3 Score 7.1
References
Products affected by CVE-2026-62219
-
cpe:2.3:a:openclaw:openclaw:2026.2.12
-
cpe:2.3:a:openclaw:openclaw:2026.2.13
-
cpe:2.3:a:openclaw:openclaw:2026.2.14
-
cpe:2.3:a:openclaw:openclaw:2026.2.15
-
cpe:2.3:a:openclaw:openclaw:2026.2.17
-
cpe:2.3:a:openclaw:openclaw:2026.2.17.2
-
cpe:2.3:a:openclaw:openclaw:2026.2.19
-
cpe:2.3:a:openclaw:openclaw:2026.2.19-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.19-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.21
-
cpe:2.3:a:openclaw:openclaw:2026.2.21-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.21-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.22
-
cpe:2.3:a:openclaw:openclaw:2026.2.22-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.22-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.23
-
cpe:2.3:a:openclaw:openclaw:2026.2.24
-
cpe:2.3:a:openclaw:openclaw:2026.2.25
-
cpe:2.3:a:openclaw:openclaw:2026.2.26
-
cpe:2.3:a:openclaw:openclaw:2026.2.61
-
cpe:2.3:a:openclaw:openclaw:2026.2.62
-
cpe:2.3:a:openclaw:openclaw:2026.2.63
-
cpe:2.3:a:openclaw:openclaw:2026.3.1
-
cpe:2.3:a:openclaw:openclaw:2026.3.11
-
cpe:2.3:a:openclaw:openclaw:2026.3.12
-
cpe:2.3:a:openclaw:openclaw:2026.3.13
-
cpe:2.3:a:openclaw:openclaw:2026.3.2
-
cpe:2.3:a:openclaw:openclaw:2026.3.22
-
cpe:2.3:a:openclaw:openclaw:2026.3.23
-
cpe:2.3:a:openclaw:openclaw:2026.3.23-2
-
cpe:2.3:a:openclaw:openclaw:2026.3.24
-
cpe:2.3:a:openclaw:openclaw:2026.3.25
-
cpe:2.3:a:openclaw:openclaw:2026.3.28
-
cpe:2.3:a:openclaw:openclaw:2026.3.31
-
cpe:2.3:a:openclaw:openclaw:2026.3.7
-
cpe:2.3:a:openclaw:openclaw:2026.3.8
-
cpe:2.3:a:openclaw:openclaw:2026.4.1
-
cpe:2.3:a:openclaw:openclaw:2026.4.10
-
cpe:2.3:a:openclaw:openclaw:2026.4.11
-
cpe:2.3:a:openclaw:openclaw:2026.4.12
-
cpe:2.3:a:openclaw:openclaw:2026.4.14
-
cpe:2.3:a:openclaw:openclaw:2026.4.15
-
cpe:2.3:a:openclaw:openclaw:2026.4.19
-
cpe:2.3:a:openclaw:openclaw:2026.4.2
-
cpe:2.3:a:openclaw:openclaw:2026.4.20
-
cpe:2.3:a:openclaw:openclaw:2026.4.21
-
cpe:2.3:a:openclaw:openclaw:2026.4.22
-
cpe:2.3:a:openclaw:openclaw:2026.4.23
-
cpe:2.3:a:openclaw:openclaw:2026.4.24
-
cpe:2.3:a:openclaw:openclaw:2026.4.25
-
cpe:2.3:a:openclaw:openclaw:2026.4.26
-
cpe:2.3:a:openclaw:openclaw:2026.4.27
-
cpe:2.3:a:openclaw:openclaw:2026.4.29
-
cpe:2.3:a:openclaw:openclaw:2026.4.30
-
cpe:2.3:a:openclaw:openclaw:2026.4.4
-
cpe:2.3:a:openclaw:openclaw:2026.4.5
-
cpe:2.3:a:openclaw:openclaw:2026.4.7
-
cpe:2.3:a:openclaw:openclaw:2026.4.7-1
-
cpe:2.3:a:openclaw:openclaw:2026.4.8
-
cpe:2.3:a:openclaw:openclaw:2026.4.9
-
cpe:2.3:a:openclaw:openclaw:2026.5.10
-
cpe:2.3:a:openclaw:openclaw:2026.5.12
-
cpe:2.3:a:openclaw:openclaw:2026.5.14
-
cpe:2.3:a:openclaw:openclaw:2026.5.16
-
cpe:2.3:a:openclaw:openclaw:2026.5.18
-
cpe:2.3:a:openclaw:openclaw:2026.5.19
-
cpe:2.3:a:openclaw:openclaw:2026.5.2
-
cpe:2.3:a:openclaw:openclaw:2026.5.20
-
cpe:2.3:a:openclaw:openclaw:2026.5.21
-
cpe:2.3:a:openclaw:openclaw:2026.5.22
-
cpe:2.3:a:openclaw:openclaw:2026.5.23
-
cpe:2.3:a:openclaw:openclaw:2026.5.24
-
cpe:2.3:a:openclaw:openclaw:2026.5.25
-
cpe:2.3:a:openclaw:openclaw:2026.5.3
-
cpe:2.3:a:openclaw:openclaw:2026.5.3-1
-
cpe:2.3:a:openclaw:openclaw:2026.5.4
-
cpe:2.3:a:openclaw:openclaw:2026.5.5
-
cpe:2.3:a:openclaw:openclaw:2026.5.6
-
cpe:2.3:a:openclaw:openclaw:2026.5.7
-
cpe:2.3:a:openclaw:openclaw:2026.5.9