Is CVE-2026-62220 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-62220?

CVE-2026-62220 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-62220

Description

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.