{"id":"EUVD-2026-28201","enisaUuid":"6f7cd446-3492-3bbb-8d1b-51603f36bcae","description":"OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.","datePublished":"May 6, 2026, 7:49:37 PM","dateUpdated":"Sep 24, 2026, 2:17:45 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r6xh-pqhr-v4xh\nhttps://github.com/openclaw/openclaw/commit/3cb1a56bfc9579a0f2336f9cfa12a8a744332a19\nhttps://www.vulncheck.com/advisories/openclaw-owner-context-spoofing-via-bearer-token-header\n","aliases":"CVE-2026-44118\n","assigner":"VulnCheck","epss":0.14,"enisaIdProduct":[{"id":"06321ab6-3a22-3cd4-913e-cdffbd372f19","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.22"}],"enisaIdVendor":[{"id":"844482e6-a1e4-3153-95f0-1ce93b06212b","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"0f512a5b-deab-37d8-8717-f1854a32bfe0","vulnerability":{"id":"GHSA-35vf-vw9f-q3cr","description":"Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens","datePublished":"May 6, 2026, 9:31:42 PM","dateUpdated":"May 11, 2026, 4:12:46 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r6xh-pqhr-v4xh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44118\nhttps://github.com/openclaw/openclaw/commit/3cb1a56bfc9579a0f2336f9cfa12a8a744332a19\nhttps://www.vulncheck.com/advisories/openclaw-owner-context-spoofing-via-bearer-token-header\n","enisa_id":"EUVD-2026-28201\n","aliases":"GHSA-35vf-vw9f-q3cr\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"963c6f41-ee00-30d4-b4e5-145802e20755","vulnerability":{"id":"CVE-2026-44118","description":"OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.","datePublished":"May 6, 2026, 7:49:37 PM","dateUpdated":"Sep 24, 2026, 2:17:45 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r6xh-pqhr-v4xh\nhttps://github.com/openclaw/openclaw/commit/3cb1a56bfc9579a0f2336f9cfa12a8a744332a19\nhttps://www.vulncheck.com/advisories/openclaw-owner-context-spoofing-via-bearer-token-header\n","enisa_id":"EUVD-2026-28201\n","assigner":"VulnCheck","epss":0.14,"dataProcessed":"Oct 30, 2026, 7:17:58 AM","vulnerabilityProduct":[{"id":"85dc876b-a2d4-3677-9d55-b70377a9df67","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.22"}],"vulnerabilityVendor":[{"id":"6598f66b-c4b5-3175-9f70-8c484b625795","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[{"id":"a82f9b5d-54c3-32a8-84de-a2e3376a9ae6","advisory":{"id":"WID-SEC-W-2026-1253","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.","datePublished":"Apr 23, 2026, 10:00:00 PM","dateUpdated":"May 11, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1253.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1253\n","aliases":"CVE-2026-44113\nCVE-2026-44114\nCVE-2026-44115\nCVE-2026-44116\nCVE-2026-44118\nCVE-2026-44994\nCVE-2026-45003\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0c27982d-9666-32be-8f9e-ec474b30b6b7","product":{"name":"2026.4.22","vendor":{"name":"open source"}}},{"id":"ce404ef6-1915-3c87-a1b2-8075112ec486","product":{"name":"OpenClaw","vendor":{"name":"n/a"}}}]}}]}