CyberRota Analysis
AI-GeneratedOpenClaw versions prior to 2026.6.5 are vulnerable due to an authorization bypass in the ClickClack agent-mode dispatch feature, which may allow lower-trust callers to execute actions without proper policy checks. This flaw could lead to unauthorized access and manipulation of sensitive operations, posing a significant security risk. Organizations using affected versions should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.
Related CVEs
Other vulnerabilities affecting the same vendor(s)