Executive brief
OpenClaw is a platform for managing AI agents and tools. A security flaw in its communication gateway allowed local users or processes to impersonate the system owner by spoofing specific request headers. This could allow an unauthorized user to perform administrative actions or access sensitive tools restricted to the system owner.
Technical details
OpenClaw's Model Context Protocol (MCP) loopback implementation incorrectly derived the 'owner' context from user-controllable request headers (specifically the sender-owner header) rather than cryptographically verified tokens. An attacker with local access and low privileges can manipulate these headers to bypass owner-gated operation checks. The vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing). The fix, introduced in version 2026.4.22, involves issuing distinct bearer tokens for owner and non-owner contexts and deriving the 'senderIsOwner' status exclusively from the token used for authentication.
Affected products
- OpenClaw openclaw < 2026.4.22
Timeline
- 2026-04-21: patched: Fix committed to repository
- 2026-04-23: advisory: Original advisory GHSA-r6xh-pqhr-v4xh published
- 2026-05-06: disclosed: CVE-2026-44118 published
- 2026-05-11: other: Duplicate advisory GHSA-35vf-vw9f-q3cr withdrawn in favor of GHSA-r6xh-pqhr-v4xh