Is CVE-2026-62197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62197 being exploited in the wild.

How severe is CVE-2026-62197?

High severity, with a CVSS score of 8.5, published 13 July 2026.

Which products and versions are affected?

openclaw (npm) < 2026.6.6, SEMVER:introduced=0,fixed=2026.6.6; Openclaw before 2026.6.6.

Is there a fix for CVE-2026-62197?

Yes. openclaw (npm): upgrade to 2026.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62197 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62197?

Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62197: OpenClaw policy bypass in browser CDP discovery

Q: Which products and versions are affected?

openclaw (npm) < 2026.6.6, SEMVER:introduced=0,fixed=2026.6.6; Openclaw before 2026.6.6.

Q: Is there a fix for CVE-2026-62197?

Yes. openclaw (npm): upgrade to 2026.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62197 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-62197?

Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62197 · Severity: high · CVSS 8.5 · Published 2026-07-13

OpenClaw, a tool used for browser automation and discovery, contains a security flaw in how it handles network connections. An attacker with low-level access could bypass security policies to reach internal network destinations that should be restricted. This could lead to unauthorized access to sensitive internal data or services.

Technologies: openclaw (npm), Openclaw. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-62197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62197 being exploited in the wild.
How severe is CVE-2026-62197?: High severity, with a CVSS score of 8.5, published 13 July 2026.
Which products and versions are affected?: openclaw (npm) < 2026.6.6, SEMVER:introduced=0,fixed=2026.6.6; Openclaw before 2026.6.6.
Is there a fix for CVE-2026-62197?: Yes. openclaw (npm): upgrade to 2026.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62197 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62197?: Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openclaw (npm): upgrade to 2026.6.6 or later
```
npm install openclaw@2026.6.6
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in OpenClaw's browser Chrome DevTools Protocol (CDP) discovery feature. The component fails to properly validate WebSocket URLs against established security policies, allowing them to bypass intended blocks. An authenticated attacker with 'lower-trust' access can exploit this to reach internal network destinations. The vulnerability is present when the CDP discovery feature is enabled and reachable by untrusted inputs. A fix is available in version 2026.6.6.

Affected products

OpenClaw OpenClaw before 2026.6.6

Identifiers

CVE-2026-62197
GHSA-3x84-qq85-fj65

Timeline

2026-06-30: advisory: GitHub Security Advisory published
2026-07-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.