GHSA-RJ6P-XMXR-QJ4H OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

Summary MCP loopback could skip owner-only tool policy for non-owner callers. In affected versions, a non-owner caller reaching the affected loopback path could skip owner-only tool policy and before-tool-call hooks. This advisory is scoped to the named feature and configuration. It does not chan...

NPM: OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

NPM: OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.24...

EUVD-2026-36324

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers...

PT-2026-55417

Summary MCP loopback could skip owner-only tool policy for non-owner callers. In affected versions, a non-owner caller reaching the affected loopback path could skip owner-only tool policy and before-tool-call hooks. This advisory is scoped to the named feature and configuration. It does not chan...

PT-2026-48748

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.24 Description An authorization bypass exists in the MCP loopback feature. This allows non-owner callers to circumvent owner-only tool policies and before-tool-call hooks. When the feature is enabled and...

CVE-2026-53818: Missing Authorization

OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-only behavior through the affected loopback path to execute restricted tools...