Is CVE-2026-62188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62188 being exploited in the wild.

How severe is CVE-2026-62188?

High severity, with a CVSS score of 8.1, published 13 July 2026.

Which products and versions are affected?

@openclaw/feishu (npm) SEMVER:introduced=0,fixed=2026.6.9; Openclaw Feishu <= 2026.6.6.

Is there a fix for CVE-2026-62188?

Yes. @openclaw/feishu (npm): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62188 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62188?

Check whether you run @openclaw/feishu (npm) or Openclaw Feishu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62188: OpenClaw feishu incorrect authorization in permission tools

Q: Is there a fix for CVE-2026-62188?

Yes. @openclaw/feishu (npm): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62188 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-62188?

Check whether you run @openclaw/feishu (npm) or Openclaw Feishu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62188 · Severity: high · CVSS 8.1 · Published 2026-07-13

OpenClaw's Feishu integration, a tool used for managing permissions and communications within the Feishu platform, contains a security flaw where it may ignore specific account-level restrictions. This allows users with low-level access to bypass intended security policies and perform actions they should not be authorized to do. If exploited, this could lead to unauthorized data access or modification within the Feishu environment.

Technologies: @openclaw/feishu (npm), Openclaw Feishu. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-62188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62188 being exploited in the wild.
How severe is CVE-2026-62188?: High severity, with a CVSS score of 8.1, published 13 July 2026.
Which products and versions are affected?: @openclaw/feishu (npm) SEMVER:introduced=0,fixed=2026.6.9; Openclaw Feishu <= 2026.6.6.
Is there a fix for CVE-2026-62188?: Yes. @openclaw/feishu (npm): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62188 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62188?: Check whether you run @openclaw/feishu (npm) or Openclaw Feishu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openclaw/feishu (npm): upgrade to 2026.6.9 or later
```
npm install @openclaw/feishu@2026.6.9
```

Technical details

An incorrect authorization vulnerability (CWE-863) exists in the @openclaw/feishu package for OpenClaw. The root cause is a failure in the Feishu permission tools to respect per-account disablement settings, effectively bypassing intended policy checks. An authenticated attacker with low privileges can exploit this over the network to perform actions that should require higher authorization levels. This can result in a significant loss of confidentiality and integrity if lower-trust input paths reach the affected feature. The vulnerability is addressed in version 2026.6.9.

Affected products

OpenClaw feishu (@openclaw/feishu) <= 2026.6.6

Identifiers

CVE-2026-62188
GHSA-w8wf-3qvj-6xqf

Timeline

2026-06-30: advisory: GitHub Security Advisory published
2026-07-13: disclosed: NVD publication date
2026-07-13: patched: Fix confirmed in version 2026.6.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.