CVE-2026-53818: OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

OpenClaw marks some tools as owner-only and runs before-tool-call hooks as a policy checkpoint. On the MCP loopback path, a non-owner caller skipped both. The advisory names no function or file, so the exact code path is not public in the sources I read.

The attacker must be a non-owner caller with local access to the loopback (the CVSS vector is local, low privilege, no user interaction). The MCP loopback feature must be enabled and reachable. The result is that owner-only behaviour can be invoked through that path. The vector rates integrity impact as high and confidentiality and availability as low. Your actual exposure depends on which tools you marked owner-only and whether lower-trust input, such as a shared channel or another local user, can reach the loopback.

The advisory states that this does not change OpenClaw's trusted-operator model. Authenticated Gateway operators, installed plugins and intentional local execution surfaces stay trusted. The bug matters when you share one Gateway between users of different trust levels.

Affected: npm openclaw before 2026.4.24. Only setups with the MCP loopback feature enabled and reachable by non-owner callers are exposed.

npm ls -g openclaw

If you run OpenClaw from a project, drop the -g flag. Confirm whether the MCP loopback is enabled in your Gateway configuration.

Update to openclaw 2026.4.24 or later.

npm install -g [email protected]

Until you can update, the advisory advises restricting MCP loopback access to trusted operators. It also suggests general hardening: keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the feature when you do not need it.

The sources give no log signature. Review Gateway logs for tool calls made through the MCP loopback by callers who are not the owner, especially calls to tools you flagged as owner-only. Check whether your before-tool-call hooks recorded those calls. A missing hook entry for a loopback call is a sign the check was skipped. List who and what can reach the loopback endpoint on the host.

Summary

MCP loopback could skip owner-only tool policy for non-owner callers. In affected versions, a non-owner caller reaching the affected loopback path could skip owner-only tool policy and before-tool-call hooks.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could invoke owner-only behavior through that loopback path. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Resolution

Update to a patched OpenClaw release when one is listed for this advisory. If the Patched versions field is populated, use that version or later.

Mitigations

restrict MCP loopback access to trusted operators until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.