Liwei Ding

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.6.5 **Description** OpenClaw may forward Authorization headers during Model Context Protocol (MCP) Server-Sent Events (SSE) redirects. If the affected feature is enabled and accessible, a lower-trust caller or a configured input path could perform or persist actions that exceed the caller's intended authorization level. The overall impact is determined by the operator's configuration and the ability of lower-trust input to reach the affected path. **Recommendations** Update OpenClaw to version 2026.6.5 or later.