Sign in
Deutsch English Español Polski
Medium

OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

  • Disclosed: 25.04.2026
  • Updated: 11.10.2026 10:22

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: < 2026.4.20
  • Patched version: 2026.4.20

Impact

Bundled MCP and LSP tools could be appended to the agent's effective tool set after the normal tool-policy pipeline had already filtered core tools. If an operator configured a restrictive policy, such as a tool profile, explicit allow/deny list, owner-only tool restriction, sandbox tool policy, or subagent tool policy, a bundled MCP/LSP tool could remain available even though the same policy would have denied it.

The issue required a configured bundled MCP or LSP tool source and an operator policy that should have restricted that tool. This was a local agent policy-enforcement bypass, not an unauthenticated remote gateway compromise. Severity is medium.

Fix

OpenClaw now applies a final effective tool policy pass to bundled MCP/LSP tools before merging them into the tool set used by normal runs and compaction. The pass covers profile policy, provider profile policy, global/agent/group policies, owner-only filtering, sandbox tool policy, and subagent tool policy.

Fix commit:

  • 0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada

Release

Fixed in OpenClaw 2026.4.20.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package openclaw < 2026.4.20 2026.4.20

References

CVSS score -
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness (CWE)
CWE-862
Platform
npm
Package
openclaw
Disclosed
25.04.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qrp5-gfw2-gxv4 - CC BY 4.0

Vulnerability history: openclaw

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (588) in the archive
Total entries
588
First → latest
02.2026 07.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 20
  • High 215
  • Medium 299
  • Low 54

Disclosures per year

Severity:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    High CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    High · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    High CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    High CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    High · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    High · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    High · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    High · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    High · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    High · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    High · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Critical CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    High · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    High CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    High · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    High · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    High · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    High · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    High · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    High · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    High · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    High · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    High CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    High · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    High · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    High · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    High · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    High · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    High · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    High · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    High · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    High · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    High · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    High · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    High · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    High · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    High · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    High · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy this entry
    Medium CVE-2026-44998 < 2026.4.20 2026.4.20
  42. OpenClaw: Workspace dotenv could override runtime-control environment variables
    High · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  43. OpenClaw: Feishu webhook and card-action validation now fail closed
    Critical · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  44. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Critical · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  45. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    High CVE-2026-43533 < 2026.4.10 2026.4.10
  46. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    High · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  47. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    High · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  48. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    High · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  49. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    High · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  50. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    High CVE-2026-43581 < 2026.4.10 2026.4.10
  51. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    High · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  52. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    High · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  53. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    High · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  54. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    High CVE-2026-43528 < 2026.4.14 2026.4.14
  55. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    High CVE-2026-40037 < 2026.4.8 2026.4.8
  56. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    High · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  57. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    High CVE-2026-42427 < 2026.4.8 2026.4.8
  58. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    High ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  59. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    High ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  60. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    High · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
Show more (20) Showing 60 of 236

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.