CVSS 4.0
6.9 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2026-53818
Medium (6.9) in openclaw openclaw. EPSS 0.10% chance of exploitation in the next 30 days. Fixed in openclaw 2026.4.24.
OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-only behavior through the affected loopback path to execute restricted tools when the feature is enabled and reachable.
Severity
CVSS 3.1
6.6 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L- EPSS
- 0.10% chance of exploitation in the next 30 days; higher than 0% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rj6p-xmxr-qj4h | npm | openclaw | <2026.4.24 | 2026.4.24 |