OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate… (CVE-2026-62226)

The vulnerability identified as CVE-2026-62226 affects OpenClaw versions starting from 2026.3.28 before 2026.5.19. It is an authorization bypass issue in the browser act route where the system fails to properly validate current-tab URL checks. This improper validation enables attackers who have lower-trust access or can manipulate input paths to execute actions that should be restricted by stronger authorization or policy checks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, no user interaction, and a medium severity impact with scope change and high confidentiality impact.

Attackers with limited privileges or specific input configurations can bypass authorization controls to perform actions that require higher privileges or stricter policy enforcement. This could lead to unauthorized operations within the affected OpenClaw environment, potentially compromising confidentiality and integrity of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, restrict access to the affected routes and monitor for unusual activity related to authorization bypass attempts.