Which versions of OpenClaw are affected by CVE-2026-44118?

OpenClaw npm package versions 2026.4.21 and earlier contain an authentication bypass vulnerability that allows local low-privilege users to escalate to owner-level access by spoofing HTTP headers,…. A patch is available.

How to fix or mitigate CVE-2026-44118?

Within 24 hours: Inventory all applications and services using OpenClaw npm package and document current versions in use. Within 7 days: Upgrade OpenClaw to version 2026.4.22 or later across all development, staging, and production environments. Within 30 days: Conduct code review of any custom implementations relying on OpenClaw's MCP loopback interface for authentication decisions and validate access control logs for unauthorized owner-level operations.

OpenClaw CVE-2026-44118

Q: What is the CVSS score of CVE-2026-44118?

CVE-2026-44118 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28201 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-05-06 disclosure@vulncheck.com

GHSA-r6xh-pqhr-v4xh

Authentication Bypass Openclaw

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 21:03 EUVD

Source Code Evidence Fetched

May 06, 2026 - 20:36 vuln.today

Analysis Generated

May 06, 2026 - 20:36 vuln.today

CVE Published

May 06, 2026 - 20:16 nvd

HIGH 8.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.22.

DescriptionCVE.org

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.

AnalysisAI

Authentication bypass in OpenClaw's MCP loopback interface allows local low-privilege attackers to escalate to owner-level access. Non-owner MCP client processes can spoof the 'x-openclaw-sender-is-owner' HTTP header to impersonate the owner and access owner-gated operations. Publicly available exploit code exists via GitHub commit 3cb1a56, and VulnCheck has published a detailed advisory. The vulnerability affects OpenClaw npm package versions <= 2026.4.21, with patch 2026.4.22 available since April 2026.

Technical ContextAI

OpenClaw implements a Model Context Protocol (MCP) loopback architecture where CLI-spawned child processes communicate with the parent gateway over HTTP localhost connections. The vulnerability stems from CWE-290 (Authentication Bypass by Spoofing) in the request authentication logic. Prior to the fix, the gateway's 'resolveMcpRequestContext' function derived owner context from the client-controlled 'x-openclaw-sender-is-owner' HTTP header rather than from cryptographically validated bearer token claims. The MCP loopback runtime originally issued a single shared bearer token to all child processes and relied on the honor-system header to distinguish owner from non-owner contexts. The fix refactors the token architecture to issue distinct 'ownerToken' and 'nonOwnerToken' credentials, removing trust in the spoofable header entirely. The patch modifies 'mcp-http.loopback-runtime.ts' to generate two tokens per runtime, 'mcp-http.request.ts' to authenticate based solely on which token was presented, and 'prepare.ts' to provision the correct token to child processes based on their intended privilege level.

RemediationAI

Upgrade to OpenClaw version 2026.4.22 or later, available via npm (npm install openclaw@2026.4.22). The vendor-released patch (commit 3cb1a56bfc9579a0f2336f9cfa12a8a744332a19) has been independently verified in the published npm artifact and passed regression testing per the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-r6xh-pqhr-v4xh. No workarounds are available - the vulnerability is architectural and requires the code-level token refactoring provided in the patch. Organizations unable to upgrade immediately should restrict OpenClaw deployments to single-user trusted environments and avoid running untrusted MCP child processes until patching. Defense-in-depth: monitor localhost HTTP traffic on port 23119 for anomalous 'x-openclaw-sender-is-owner: true' headers from non-owner process PIDs (note: this detection becomes ineffective post-patch as the header is no longer emitted), and implement OS-level process isolation between owner and non-owner CLI runners using containers or separate user accounts to limit lateral movement even if OpenClaw authentication is bypassed.