Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · OpenClaw

CVE-2026-44118: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

highCVSS 4.0 8.5 · 3.1 7.8GHSA-r6xh-pqhr-v4xh

Summary MCP loopback owner context is derived from server-issued bearer tokens. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.21 - Fixed version: 2026.4.22 Impact The loopback MCP path accepted spoofable owner-context metadata from request headers, which could allow a non-owner loopback client to present itself as owner for owner-gated operations.

Published May 4, 2026 · Updated May 12, 2026

Affected packages

openclaw

Ecosystem
npm
Affected
<= 2026.4.21
Fixed in
2026.4.22
Check
npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

MCP loopback owner context is derived from server-issued bearer tokens.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.4.21
  • Fixed version: 2026.4.22

Impact

The loopback MCP path accepted spoofable owner-context metadata from request headers, which could allow a non-owner loopback client to present itself as owner for owner-gated operations.

Fix

The MCP loopback runtime now issues separate owner and non-owner bearer tokens and derives senderIsOwner exclusively from which token authenticated the request. The spoofable sender-owner header is no longer emitted or trusted.

Fix Commit(s)

  • 3cb1a56bfc9579a0f2336f9cfa12a8a744332a19

Verification

  • The fix commit is contained in the public v2026.4.22 tag.
  • [email protected] is published on npm and the compiled package contains the fix.
  • Focused regression coverage for this path passed before publication.

OpenClaw thanks @VladimirEliTokarev for reporting.

Credited to VladimirEliTokarev.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries