Plango
Get Plango

For developers

Mac security

← AI agent vulnerabilities

CVE-2026-53840

OpenClaw

7.1
Severity
High
Published
June 16, 2026
Last modified
June 17, 2026

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.

CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness

References

CVE-2026-53840 on NVD

Listed in

HighMCP servers

More OpenClaw CVEs

May 11
CVE-2026-450017.1

OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox policy,…

 May 11
CVE-2026-449957.3

OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code.

 May 6
CVE-2026-441187.8

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers.