Is CVE-2026-62189 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-62189?

CVE-2026-62189 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-62189

Description

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.