8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44118

CVE-2026-44118: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Summary

MCP loopback owner context is derived from server-issued bearer tokens.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.21
Fixed version: 2026.4.22

Impact

The loopback MCP path accepted spoofable owner-context metadata from request headers, which could allow a non-owner loopback client to present itself as owner for owner-gated operations.

Fix

The MCP loopback runtime now issues separate owner and non-owner bearer tokens and derives senderIsOwner exclusively from which token authenticated the request. The spoofable sender-owner header is no longer emitted or trusted.

Fix Commit(s)

3cb1a56bfc9579a0f2336f9cfa12a8a744332a19

Verification

The fix commit is contained in the public v2026.4.22 tag.
openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
Focused regression coverage for this path passed before publication.

OpenClaw thanks @VladimirEliTokarev for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44118

CVE-2026-44118:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.21	2026.4.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw allowed a non-owner to gain owner privileges on the MCP loopback path. This was possible because the owner status was determined by the x-openclaw-sender-is-owner HTTP header, which could be easily spoofed by a malicious client. The core of the vulnerability lies in the resolveMcpRequestContext function, which trusted this header to determine the senderIsOwner flag.

The patch addresses this by fundamentally changing the authentication mechanism for the loopback interface. Instead of a single bearer token and a spoofable header, the system now generates two distinct tokens: an ownerToken and a nonOwnerToken. The validateMcpLoopbackRequest function was updated to check for either of these tokens and determine the senderIsOwner status based on which token was provided. Consequently, resolveMcpRequestContext was changed to rely on this secure, token-based authentication result instead of the insecure header. Any runtime profiler capturing an exploit would likely show validateMcpLoopbackRequest and resolveMcpRequestContext in the stack trace as they are directly responsible for processing the malicious request.

Vulnerable functions

resolveMcpRequestContext

src/gateway/mcp-http.request.ts

The `resolveMcpRequestContext` function was vulnerable because it determined if a user was an owner based on the `x-openclaw-sender-is-owner` header. An attacker could spoof this header to gain owner privileges. The patch removes the reliance on this header and instead uses the result of the new authentication mechanism.

validateMcpLoopbackRequest

src/gateway/mcp-http.request.ts

The `validateMcpLoopbackRequest` function was insufficient because it only validated a single, generic bearer token. It did not distinguish between tokens that should grant owner privileges and those that should not. The patch introduces separate owner and non-owner tokens and validates against both, determining the `senderIsOwner` status from the token used.

startMcpLoopbackServer

src/gateway/mcp-http.ts

The `startMcpLoopbackServer` function was involved in the vulnerability by creating and using a single bearer token for all loopback communication. This did not allow for distinguishing between owner and non-owner contexts. The patch modifies this function to generate separate tokens for owners and non-owners, which is a core part of the fix.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44118: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Summary

Affected Packages / Versions

Impact

Fix

Fix Commit(s)

Verification

CVE-2026-44118:

8.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2026-44118: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Summary

Affected Packages / Versions

Impact

Fix

Fix Commit(s)

Verification

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.5

8.5

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI