CyberRota Analysis
AI-GeneratedOpenClaw versions prior to 2026.6.5 are vulnerable to improper handling of Authorization headers during MCP SSE redirects, potentially allowing lower-trust callers to execute unauthorized actions. The impact varies based on the operator's configuration and the accessibility of lower-trust inputs to the affected feature. Organizations using OpenClaw should prioritize this vulnerability to prevent unauthorized access and actions within their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path.
Related CVEs
Other vulnerabilities affecting the same vendor(s)