Описание
OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.
Ссылки
- MitigationVendor Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 2026.5.20 (включая) до 2026.6.6 (исключая)
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 14%
0.0023
Низкий
8.3 High
CVSS3
Дефекты
CWE-732
Связанные уязвимости
CVSS3: 8.3
github
около 1 месяца назад
OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.
EPSS
Процентиль: 14%
0.0023
Низкий
8.3 High
CVSS3
Дефекты
CWE-732