CVE-2026-62191 is an authorization bypass vulnerability in OpenClaw versions prior to 2026.6.9. The vulnerability arises from improper authorization checks in message mutation handling, enabling lower-trust callers to bypass intended access controls. Attackers exploiting this vulnerability can perform privileged operations without proper authorization if the vulnerable feature is enabled and accessible. No known exploits in the wild have been reported. The vulnerability is categorized under CWE-862 (Improper Authorization).

Successful exploitation allows attackers with lower trust levels to bypass authorization controls and execute privileged actions. This could lead to unauthorized operations that compromise system integrity or security. The vulnerability affects confidentiality and integrity due to unauthorized access to privileged functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, review and restrict access to the affected feature and ensure input paths are properly configured to prevent unauthorized access.