CVE-2026-62229 describes an authorization bypass vulnerability in OpenClaw prior to version 2026.5.18. The issue arises from improper handling of exec allowlist glob matching, which attackers can exploit by crafting input paths that circumvent the intended authorization controls. This enables lower-privileged users to perform actions beyond their permissions when the feature is active. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No known exploits are reported in the wild, and no patch links are currently provided.

The vulnerability allows unauthorized execution or persistence of actions by lower-trust callers, potentially leading to privilege escalation or unauthorized system modifications. The impact is high due to the bypass of authorization controls, but there is no evidence of active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently referenced, users should monitor vendor communications for updates. Until a fix is available, consider disabling the affected feature if feasible to reduce risk.