PT-2026-38251

CVE-2026-44118

Published

2026-04-23

Updated

2026-09-11

Description by

CVSS 4.0

8.5

High

MetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.22

Description OpenClaw derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can bypass owner-gated operations by manipulating the sender-owner header metadata or the senderIsOwner flag, allowing them to present themselves as the owner and gain full owner control.

Recommendations Update to version 2026.4.22.

Exploitability

Exploit

Fix

Impacts

Researchers

Vladimir Tokarev

Vendors

Affected products

Weakness enumeration

CWE-290: Authentication Bypass by Spoofing

CWE-284: Improper Access Control