Zaloguj się
Deutsch English Español Polski
Wysoka

OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin

  • Ujawniono: 17.06.2026
  • Aktualizacja: 11.10.2026 10:22

Summary

OpenClaw supports remote MCP Streamable HTTP servers with operator-configured custom headers. In affected releases, those headers could be forwarded when the MCP endpoint responded with a cross-origin redirect.

This issue is limited to configured MCP Streamable HTTP servers that use custom headers. It does not expose unrelated OpenClaw credentials.

Affected configurations

This affects deployments where an MCP server is configured with:

  • transportType: "streamable-http"
  • sensitive custom headers under mcp.servers.*.headers
  • an MCP endpoint that is malicious, compromised, or able to redirect to another origin

Impact

Custom MCP headers, such as API keys or tenant-routing headers, could be sent to the redirect target. The exposed credential scope depends on the header the operator configured for that MCP server.

Patched Versions

The first stable patched version is 2026.5.12.

Mitigations

Upgrade to openclaw@2026.5.8 or later. Before upgrading, avoid custom MCP headers with servers you do not fully trust, and rotate any MCP-specific credentials that may have been exposed by a redirecting endpoint.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka npm openclaw < 2026.5.12 2026.5.12

Odnośniki

Ocena CVSS 7.1/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Słabość (CWE)
CWE-200
Platforma
npm
Paczka
openclaw
Ujawniono
17.06.2026
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-rjxq-qqhf-8hwh - CC BY 4.0

Historia podatności: openclaw

Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (588) w archiwum
Wszystkich wpisów
588
Pierwsza → ostatnia
02.2026 07.2026
Bez poprawki
9
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 20
  • Wysoka 215
  • Średnia 299
  • Niska 54

Ujawnienia w latach

Istotność:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    Wysoka CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Wysoka · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Wysoka CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Wysoka CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    Wysoka · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Wysoka · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Wysoka · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    Wysoka · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Wysoka · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Wysoka · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Wysoka · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Krytyczna CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Wysoka · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    Wysoka CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Wysoka · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Wysoka · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Wysoka · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Wysoka · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Wysoka · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Wysoka · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Wysoka · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Wysoka · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    Wysoka CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    Wysoka · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    Wysoka · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Wysoka · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Wysoka · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    Wysoka · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Wysoka · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Wysoka · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    Wysoka · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Wysoka · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Wysoka · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Wysoka · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Wysoka · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Wysoka · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin ten wpis
    Wysoka · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Wysoka · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Wysoka · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Wysoka · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Wysoka · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  42. OpenClaw: Feishu webhook and card-action validation now fail closed
    Krytyczna · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  43. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Krytyczna · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  44. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Wysoka CVE-2026-43533 < 2026.4.10 2026.4.10
  45. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Wysoka · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  46. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Wysoka · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  47. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Wysoka · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  48. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Wysoka · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  49. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Wysoka CVE-2026-43581 < 2026.4.10 2026.4.10
  50. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Wysoka · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  51. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Wysoka · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  52. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Wysoka · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  53. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Wysoka CVE-2026-43528 < 2026.4.14 2026.4.14
  54. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Wysoka CVE-2026-40037 < 2026.4.8 2026.4.8
  55. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Wysoka · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  56. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Wysoka CVE-2026-42427 < 2026.4.8 2026.4.8
  57. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Wysoka ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  58. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Wysoka ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  59. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Wysoka · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  60. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Wysoka · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  61. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    Wysoka CVE-2026-34511 < 2026.4.2 2026.4.2
  62. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    Wysoka CVE-2026-41393 < 2026.3.31 2026.3.31
  63. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    Wysoka · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  64. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    Wysoka CVE-2026-41353 < 2026.3.22 2026.3.22
  65. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    Wysoka · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  66. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Krytyczna · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  67. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    Wysoka · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  68. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    Wysoka CVE-2026-41404 < 2026.3.31 2026.3.31
  69. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    Wysoka CVE-2026-41349 < 2026.3.28 2026.3.28
  70. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    Wysoka · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  71. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    Wysoka · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  72. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    Wysoka · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  73. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    Wysoka CVE-2026-41366 < 2026.3.31 2026.3.31
  74. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    Wysoka · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  75. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    Wysoka · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  76. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    Wysoka · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  77. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    Wysoka · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  78. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Krytyczna CVE-2026-41329 < 2026.3.31 2026.3.31
  79. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    Wysoka · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  80. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Krytyczna · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
Pokaż więcej (20) Widać 80 z 235

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.