OpenClaw denylist bypass in bundle MCP loopback session spawn

Executive brief

OpenClaw is an automation or gateway tool that uses the Model Context Protocol (MCP). A security flaw in its 'bundle MCP loopback' feature allows certain commands to bypass a restricted list of prohibited actions. If exploited, an attacker could execute commands that were intended to be blocked, potentially leading to unauthorized system access or data manipulation depending on the specific configuration.

Technical details

A vulnerability in OpenClaw's Model Context Protocol (MCP) implementation occurs when spawning sessions via the bundled MCP loopback path. The system fails to properly apply the configured execution denylist to these sessions. An attacker capable of reaching the affected session-spawn path can bypass intended security restrictions to execute prohibited commands. This is classified as a combination of Improper Access Control (CWE-284) and potential OS Command Injection (CWE-78). The issue is resolved in version 2026.5.12.

Affected products

• OpenClaw openclaw < 2026.5.12

Timeline

• 2026-05-28: disclosed
• 2026-07-02: advisory
• 2026-05-12: patched: First stable patched version released.

References

• https://api.github.com/users/cantinagen
• https://github.com/cantinagen
• https://api.github.com/users/cantinagen/gists%7B/gist_id%7D
• https://api.github.com/users/cantinagen/repos
• https://avatars.githubusercontent.com/u/283734772?v=4
• https://api.github.com/users/cantinagen/events%7B/privacy%7D