GHSA-9c3v-684m-579c: OpenClaw MCP SSE redirects could forward Authorization headers

OpenClaw can connect to MCP servers over SSE (Server-Sent Events) and send an Authorization header with the request. In affected versions, a redirect on that connection did not strip the header, so it went to wherever the redirect pointed (CWE-601, with credential exposure under CWE-200 and CWE-522). The advisory does not say which redirect codes or which hosts are involved, and it does not say whether a cross-origin redirect is required.

The attacker needs to control or influence an MCP SSE endpoint that your Gateway connects to, or a URL on its path, so that it answers with a redirect to a host they run. The CVSS 3.1 vector is network, low complexity, low privileges, no user interaction, with high confidentiality impact only. What they capture is the bearer token or other credential configured for that MCP server. That may give them access to the real MCP service.

The advisory text on impact is generic and leaves OpenClaw's trusted-operator model unchanged. Exposure depends on your configuration and on whether lower-trust input can set or influence the MCP SSE server URL.

Affected: npm openclaw before 2026.6.5. You are exposed if you configure MCP servers that use the SSE transport with an Authorization header.

npm ls -g openclaw

Drop -g for a project install. Review your MCP server entries in the OpenClaw configuration for SSE URLs with credentials.

Update to openclaw 2026.6.5, the first stable patched version.

npm install -g [email protected]

Before you upgrade, the advisory advises limiting the MCP SSE feature to trusted operators or disabling it if you do not need it. It also suggests narrow channel and tool allowlists and not sharing one Gateway between mutually untrusted users. Rotate tokens that your SSE MCP servers used if you suspect a redirect to an untrusted host.

The advisory gives no log line. Check the access logs of your MCP SSE servers and any proxies for redirect responses (3xx) on the SSE endpoint. Look at the destination hosts of those redirects. On the redirect target, look for inbound requests that carry your Authorization header. Check for use of the MCP credential from unfamiliar addresses. Beam records agent MCP tool calls, which helps show what an MCP server was asked to do with that credential.

Summary

MCP SSE redirects could forward Authorization headers. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.6.5.

Mitigations

Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.