Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the /mcp set and /mcp unset chat commands, which fail to enforce owner-level authorization checks on non-owner external-channel senders. An authenticated non-own...

CVE-2026-100596 OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...

CVE-2026-100596 OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...

PT-2026-99232

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient authorization for non-owner users allows the execution of MCP configuration changes via the '/mcp set' and '/mcp unset' endpoints. This flaw enables attackers to persist arbitrary...