OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. (CVE-2026-62219)

CVE-2026-62219 affects OpenClaw versions starting from 2026.2.12 up to but excluding 2026.5.26. The vulnerability arises from improper validation of allowedAgentIds in hooks, permitting an attacker with lower privileges or through certain input paths to bypass agent ID restrictions by submitting blank agent IDs. This bypass enables unauthorized execution of actions that normally require higher authorization or policy enforcement. The issue is an authorization bypass classified as CWE-863. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

An attacker with lower privileges or through a configured input path can bypass agent ID restrictions, potentially performing actions that require stronger authorization or policy checks. This could lead to unauthorized access or operations within the affected OpenClaw system. The impact is considered medium severity based on the potential for privilege escalation and unauthorized action execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected OpenClaw versions and monitor for unusual activity related to agent ID submissions. Avoid using affected versions in sensitive environments if possible.