OpenClaw Vulnerability: Bypass of Exec Denylist on Session Spawn
Summary
GHSA-qh2f-99mv-mrcf: OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn. Affects openclaw versions < 2026.5.12. Fixed in 2026.5.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing and orchestrating various operations within a software environment. It provides functionalities for session management, plugin integration, and operator controls. However, a vulnerability has been identified in its bundled MCP loopback feature, which could allow unauthorized command execution under certain conditions.
Vulnerability Detail
The vulnerability arises from a flaw in the Bundle MCP loopback mechanism, which may bypass its intended exec denylist during session spawn. If an attacker can access the affected session-spawn path, they could initiate a session with broader command capabilities than intended. This could lead to unauthorized actions being executed, depending on the operator's configuration and the trust level of the input reaching that path.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.12
This is the first release that contains the fix.
npm install openclaw@2026.5.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the bundled MCP loopback feature to trusted operators only. Additionally, maintain narrow channel and tool allowlists, avoid sharing a Gateway between untrusted users, and disable the affected feature when it is not in use.
Conclusion
The OpenClaw vulnerability related to the Bundle MCP loopback feature poses a risk of unauthorized command execution. It is crucial to update to the patched version 2026.5.12 to mitigate this risk. Implementing temporary workarounds can help secure your environment until the update is applied.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability has a CVSS score of 6.9, indicating a moderate level of severity.
If exploited, this vulnerability could allow unauthorized command execution, potentially leading to broader access than intended.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
In the meantime, restrict access to the vulnerable feature and ensure that only trusted operators can use it.
For more details, refer to the official advisory on GitHub or consult the OpenClaw documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
