Vulnerability Description
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.5.28 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-prwc-c6w5-mmgrMitigationVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-bot-framework-ssrf-via-serviceurl-Third Party Advisory
FAQ
What is CVE-2026-62214?
CVE-2026-62214 is a vulnerability with a CVSS score of 6.5 (MEDIUM). OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validat...
How severe is CVE-2026-62214?
CVE-2026-62214 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-62214?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.