OpenClaw CVE-2026-102807

Requires the attacker to already possess a valid operator.read Gateway token for OpenClaw; with that token they call the mcp.app.view method to mint a standalone MCP App ticket and redeem it at the /__openclaw__/mcp-app/view endpoint to invoke tools/call operations. The flaw only manifests when the originating run has an App-tool grant (allowedAppToolNames defined and not readOnly), since the pre-fix supportsStandaloneToolOperations check validated only the run's allowlist and never the ticket issuer's own Gateway scope. Exploitation is limited to holders of a read-scoped token (no unauthenticated access) and affects OpenClaw versions before 2026.9.4; no user interaction is required.

This is a genuine but moderate-severity authorization flaw, not an overhyped high-CVSS issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N) scores 6.0 and is internally consistent with the description: exploitation requires an already-issued operator.read token (PR:L, so authenticated), is network-reachable, but has an attack requirement (AT:P) reflecting the two-step ticket-issue-then-redeem sequence. Impact is integrity-only (VI:H) - the attacker gains the ability to invoke state-changing MCP App tools they should not reach - with no confidentiality (VC:N) or availability (VA:N) impact, so the 6.0 is well-calibrated rather than inflated. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input, so there is no evidence of active or automatable exploitation; this is a privilege-boundary weakness that a legitimate low-scope operator could abuse rather than an internet-wide unauthenticated RCE. The single most important limiting factor is that the attacker must already hold a valid operator.read token, which confines the threat to insiders or attackers who have already compromised a read-scoped credential.

An attacker holding only an operator.read Gateway token calls the mcp.app.view method to obtain a standalone MCP App ticket, which (before the fix) was issued without recording that the requester lacked operator.write scope. They then redeem that ticket against the /__openclaw__/mcp-app/view endpoint and issue tools/call requests to invoke state-changing App tools, effectively escalating from read-only to write. No public exploit code is identified in the input, but the fix commit and PR diff clearly demonstrate the exploitable code path.