CVE-2026-53840: OpenClaw Vulnerability in MCP Streamable HTTP Redirects Exposes Custom Headers
Summary
CVE-2026-53840: OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin. Affects openclaw versions < 2026.5.12. Fixed in 2026.5.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source software package that facilitates the integration of remote MCP Streamable HTTP servers. It allows operators to configure custom headers for communication with these servers. However, a vulnerability exists that could lead to the exposure of sensitive information through cross-origin redirects.
Vulnerability Detail
The vulnerability arises from OpenClaw's handling of MCP Streamable HTTP servers that utilize custom headers. When an MCP endpoint responds with a cross-origin redirect, the configured custom headers may be forwarded to the new origin. This could lead to the exposure of sensitive information, such as API keys or tenant-routing headers, depending on what the operator has configured. The issue is limited to deployments where the MCP server is configured with sensitive custom headers and a potentially malicious or compromised endpoint.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.12
This is the first release that contains the fix.
npm install openclaw@2026.5.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Before upgrading, avoid using custom MCP headers with servers that you do not fully trust. Additionally, consider rotating any MCP-specific credentials that may have been exposed due to this vulnerability.
Conclusion
The vulnerability identified as CVE-2026-53840 in OpenClaw poses a significant risk by potentially exposing sensitive custom headers through cross-origin redirects. It is crucial to upgrade to the patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Custom headers that may be affected include sensitive information such as API keys or tenant-routing headers configured under mcp.servers.*.headers.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot upgrade immediately, avoid using custom MCP headers with untrusted servers and rotate any exposed credentials.
No, this vulnerability does not expose unrelated OpenClaw credentials; it is limited to the custom headers configured for the MCP Streamable HTTP servers.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
