VYPR
← All advisories
High severity7.8NVD Advisory· Published May 6, 2026· Updated May 7, 2026

CVE-2026-44118

CVE-2026-44118

Description

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.4.222026.4.22

Affected products

3
  • OpenClaw/Openclawreferences2 versions
    (expand)+ 1 more
    • (no CPE)
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.22
  • ghsa-coords
    pkg:npm/openclaw
    Range: < 2026.4.22

Patches

Vulnerability mechanics

References

5

News mentions

4