7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-35vf-vw9f-q3cr

GHSA-35vf-vw9f-q3cr: Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r6xh-pqhr-v4xh. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-35vf-vw9f-q3cr

GHSA-35vf-vw9f-q3cr:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.22	2026.4.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed a non-owner to gain owner privileges by spoofing the x-openclaw-sender-is-owner header in loopback requests to the MCP (Master Control Program). The root cause was a flaw in how the owner context was determined.

The analysis of the patch commit 3cb1a56bfc9579a0f2336f9cfa12a8a744332a19 reveals two key functions involved:

resolveMcpRequestContext: This function was directly responsible for the vulnerability. It read the x-openclaw-sender-is-owner header from the incoming request and used its value to set the senderIsOwner property in the request context. This is a classic case of trusting user-provided data for a security-critical decision.
validateMcpLoopbackRequest: This function was indirectly responsible. Its original implementation only validated a single bearer token, which authenticated the request as a valid loopback request but did not convey any information about the sender's privilege level (owner vs. non-owner). This design necessitated the use of the insecure header-based mechanism in resolveMcpRequestContext.

The fix addresses this by introducing two separate bearer tokens: one for owners (ownerToken) and one for non-owners (nonOwnerToken). The validateMcpLoopbackRequest function was updated to check for both tokens and securely determine the senderIsOwner status based on which token was provided. This status is then passed to resolveMcpRequestContext, removing the reliance on the spoofable header.

During exploitation, a profiler would show calls to validateMcpLoopbackRequest followed by resolveMcpRequestContext for every incoming MCP loopback request. An attacker would craft a request with the x-openclaw-sender-is-owner header set to true, and these functions would process it, leading to the privilege escalation.

Vulnerable functions

resolveMcpRequestContext

src/gateway/mcp-http.request.ts

This function was vulnerable because it determined the sender's ownership status by reading the 'x-openclaw-sender-is-owner' header from the request. This header was user-controllable, allowing a non-owner to spoof their status to 'true' and gain elevated privileges.

validateMcpLoopbackRequest

src/gateway/mcp-http.request.ts

The original implementation of this function was insufficient as it only validated a single generic bearer token for loopback requests. It did not differentiate between owner and non-owner requests, which forced the application to rely on the insecure 'x-openclaw-sender-is-owner' header for authorization. The patch rectifies this by introducing separate owner and non-owner tokens and determining the sender's status based on the token provided.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.