CVE-2026-62211
Last modified
CVE-2026-62211 is a medium-severity vulnerability rated 5/10 on the CVSS scale. OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted boundaries. Attackers can exploit misconfigured input paths or feature accessibility to expose sensitive credentials and data through the export mechanism.. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted boundaries. Attackers can exploit misconfigured input paths or feature accessibility to expose sensitive credentials and data through the export mechanism.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.6.1 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-j4cx-jvq7-79vmMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-62211?
How severe is CVE-2026-62211?
How do I fix CVE-2026-62211?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-62206OpenClaw versions before 2026.6.9 contain a missing authoriz…7.1
- CVE-2026-62207OpenClaw versions before 2026.6.5 contain an authentication …8.8
- CVE-2026-62208OpenClaw before 2026.6.5 could forward Authorization headers…6.5
- CVE-2026-62209OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain a…8.1
- CVE-2026-6221Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-62210OpenClaw versions before 2026.6.1 contain a denial of servic…6.5
- CVE-2026-62212OpenClaw before 2026.5.28 contains a race condition in the M…7.1
- CVE-2026-62213OpenClaw versions before 2026.5.27 contain a token leakage v…6.5
- CVE-2026-62214OpenClaw versions before 2026.5.28 Bot Framework contains an…6.5
- CVE-2026-62215OpenClaw versions before 2026.6.5 contain an authentication …8
- CVE-2026-62216OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass …5
- CVE-2026-62217OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an author…8.8
Are you affected by CVE-2026-62211?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST