CVE-2026-62203
Last modified
CVE-2026-62203 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.6.6 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-wxh3-g47h-q3mcMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-62203?
How severe is CVE-2026-62203?
How do I fix CVE-2026-62203?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-62198OpenClaw versions 2026.5.28 before 2026.6.6 contain an autho…5.4
- CVE-2026-62199OpenClaw versions before 2026.6.6 contain a flaw in host exe…8.8
- CVE-2026-6220A vulnerability was identified in HummerRisk up to 1.5.0. Th…4.7
- CVE-2026-62200OpenClaw versions before 2026.6.6 contain a flaw in host exe…8.8
- CVE-2026-62201OpenClaw versions before 2026.6.6 contain a network policy b…7.7
- CVE-2026-62202OpenClaw versions 2026.6.1 before 2026.6.9 contain a privile…8.8
- CVE-2026-62205OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a…7.1
- CVE-2026-62206OpenClaw versions before 2026.6.9 contain a missing authoriz…7.1
- CVE-2026-62207OpenClaw versions before 2026.6.5 contain an authentication …8.8
- CVE-2026-62208OpenClaw before 2026.6.5 could forward Authorization headers…6.5
- CVE-2026-62209OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain a…8.1
- CVE-2026-6221Rejected reason: This CVE ID has been rejected or withdrawn …
Are you affected by CVE-2026-62203?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST