PT-2026-48748

CVE-2026-53818

Published

2026-06-11

Updated

2026-07-02

Description by

CVSS 4.0

6.9

Medium

MetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.24

Description An authorization bypass exists in the MCP loopback feature. This allows non-owner callers to circumvent owner-only tool policies and before-tool-call hooks. When the feature is enabled and reachable, attackers can use the affected loopback path to invoke owner-only behavior and execute restricted tools.

Recommendations Update to version 2026.4.24. As a temporary workaround, disable the MCP loopback feature to prevent unauthorized execution of restricted tools.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Qclawer

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers