PT-2026-38251 · Openclaw · Openclaw

Vladimir Tokarev · Published 2026-05-04 · Updated 2026-05-19 · CVE-2026-44118

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.22

Description OpenClaw derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can bypass owner-gated operations by manipulating the sender-owner header metadata or the senderIsOwner flag, allowing them to present themselves as the owner and gain full owner control.

Recommendations Update to version 2026.4.22.

Fix

LPE

Authentication Bypass by Spoofing

Improper Access Control

Weakness Enumeration

CWE-290

CWE-284

Related Identifiers

CVE-2026-44118

GHSA-35VF-VW9F-Q3CR

GHSA-R6XH-PQHR-V4XH

Affected Products

Openclaw

References · 16

• https://github.com/openclaw/openclaw/security/advisories/GHSA-r6xh-pqhr-v4xh · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/3cb1a56bfc9579a0f2336f9cfa12a8a744332a19 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-44118 · Security Note
• https://osv.dev/vulnerability/GHSA-35vf-vw9f-q3cr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r6xh-pqhr-v4xh · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2052143607990124650 · Twitter Post
• https://twitter.com/TheHackersNews/status/2056016714106839364 · Twitter Post
• https://t.me/true_secator/8221 · Telegram Post
• https://vulncheck.com/advisories/openclaw-owner-context-spoofing-via-bearer-token-header · Note
• https://reddit.com/r/pwnhub/comments/1tdyfar/openclaw_vulnerabilities_enable_data_theft_and · Reddit Post
• https://twitter.com/CVEnew/status/2052430102365950159 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1tgnwvt/openclaw_flaws_enable_backdoor_access_through · Reddit Post
• https://twitter.com/brandonbango/status/2055344980835614796 · Twitter Post
• https://t.me/CVEtracker/52912 · Telegram Post