CVE-2026-62190 describes an authorization bypass vulnerability in OpenClaw's flock wrapper component affecting versions prior to 2026.6.9. The vulnerability allows attackers with lower trust levels to circumvent intended authorization controls by leveraging configured input paths. This bypass impacts durable exec approval binding, permitting unauthorized execution or persistence of actions when the vulnerable feature is active. No known exploits are reported in the wild, and the vulnerability is categorized under CWE-706 (Use of Incorrectly-Resolved Name or Reference).

Successful exploitation enables attackers with limited privileges to execute or persist unauthorized operations beyond their assigned authorization scope. This could lead to privilege escalation or unauthorized system modifications if the vulnerable feature is enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider disabling the affected feature if possible to reduce exposure.