OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

Summary Bundle MCP loopback could miss its exec denylist on session spawn. In affected versions, a caller that can reach the affected bundled MCP session-spawn path could bypass the denylist that was intended for that loopback MCP entry point. This advisory is scoped to the named feature and...

CVE-2026-53820

OpenClaw contains an exec denylist bypass in the bundle MCP loopback session-spawn path prior to version 2026.5.12. This allows authenticated callers to bypass command restrictions and initiate sessions with broader command reach than intended. Affected component: bundle MCP session-spawn; root c...