CVE-2026-62218 is an authorization bypass vulnerability in OpenClaw prior to version 2026.5.27. The vulnerability exists in the device.pair.approve feature, where attackers with lower trust levels can circumvent role-management checks. This enables them to execute actions that should require higher authorization privileges by exploiting configured input paths to reach the vulnerable feature.

Attackers exploiting this vulnerability can perform privileged actions without proper authorization, potentially leading to unauthorized control or configuration changes within the affected system. The vulnerability undermines role-based access controls, increasing the risk of privilege escalation and unauthorized operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates and apply any available patches promptly once released. Until then, restrict access to the affected feature and limit exposure to lower-trust callers where possible.