OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to… (CVE-2026-62225)

CVE-2026-62225 describes an authorization bypass vulnerability in OpenClaw's skill command dispatch mechanism present in versions prior to 2026.5.18. The flaw permits attackers with lower trust levels to circumvent policy restrictions and perform unauthorized actions when the vulnerable feature is active. This could lead to execution or persistence of commands beyond the caller's intended authorization scope.

Attackers can bypass authorization controls to execute or maintain actions beyond their permission level, potentially violating security policies. However, exploitation requires the affected feature to be enabled and accessible. No known exploits are reported in the wild, and the severity is assessed as low.

A fix is available in OpenClaw version 2026.5.18. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official fix.