CVE-2026-102807

Versions of OpenClaw prior to 2026.9.4 are vulnerable to an incorrect authorization flaw in the mcp.app.view method. This vulnerability allows operators with only operator.read scope to obtain a standalone ticket that can be redeemed at the MCP app view endpoint. By doing so, an attacker can bypa...