CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

EUVD-2026-87478

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573

OpenClaw versions prior to 2026.8.1 are vulnerable to a sandbox policy bypass within the MCP loopback component . This flaw enables sandboxed coding-agent sessions to circumvent the sandbox.tools.deny policy, allowing them to list and invoke tools that were explicitly restricted by the operator. ...

CVE-2026-96524: Cross-Site Request Forgery (CSRF)

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

CVE-2026-96526: Exposure of Sensitive Information to an Unauthorized Actor

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96525: Missing Authorization

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-100633: Incorrect Authorization

SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard util.IsForbiddenAbsPath, invoked from resolvePath is applied only to the allowed root of recursive operations and not to each resolved descendant path — an...

CVE-2026-100596: Missing Authorization

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...

PT-2026-99249

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description The plugin fails to perform ownership or sufficient capability checks on its REST routes used to create, update, and delete workflows. This allows users with the Contributor role to...

PT-2026-99248

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests under certain conditions. This allows an unauthenticated attacker to perform actio...

PT-2026-99250

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description An object-level authorization check is missing on a workflow REST route. This allows users with the Contributor role to disclose the title and publication status of any post, page, o...

PT-2026-99209

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description A sandbox policy bypass exists in the MCP loopback component. This issue allows sandboxed coding-agent sessions to invoke tools that are explicitly restricted by the sandbox.tools.deny policy. An...

PT-2026-99232

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient authorization for non-owner users allows the execution of MCP configuration changes via the '/mcp set' and '/mcp unset' endpoints. This flaw enables attackers to persist arbitrary...

PT-2026-99223

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient validation of owner authorization occurs within the Codex computer-use installation command. This allows senders in a channel who are not owners to install arbitrary plugins and...

PT-2026-99221

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description The openclaw npm package fails to enforce owner-only authorization for Claude Code permission prompts sent via the MCP channel bridge. This allows an authorized non-owner with channel command...

CVE-2026-100585: Missing Authorization

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

CVE-2026-100587: Missing Authorization

OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...