vulnerability · openclaw

OpenAI-compatible HTTP model overrides could miss admin authorization

OpenAI-compatible HTTP model overrides could miss admin authorization. The official advisory identifies openclaw <= 2026.6.6 as affected.

high severityconfirmed confidencepatchedNo known exploitation

Quick answer

What defenders need to know

What is it?: OpenAI-compatible HTTP model overrides could miss admin authorization. The official advisory identifies openclaw <= 2026.6.6 as affected.
Who is affected?: openclaw <= 2026.6.6
What should defenders do?: Upgrade openclaw to 2026.6.8 or later.
Is a fix available?: Yes. Upgrade to 2026.6.8.

01 / Response

Upgrade openclaw to 2026.6.8 or later.
Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed.

02 / Technical assessment

OpenClaw's official security advisory assigns high severity with CVSS 7.6 and references CWE-862, CWE-863.

Official advisory: OpenAI-compatible HTTP model overrides could miss admin authorization.
Affected range: <= 2026.6.6. First patched version: 2026.6.8.

03 / Timeline