CVE-2026-53840: OpenClaw MCP Header Leakage Vulnerability (CVSS 7.1)

Technical summary

The vulnerability resides in OpenClaw's streamable-http MCP server implementation, which fails to sanitize operator-configured custom headers during cross-origin HTTP redirects. When an MCP endpoint issues a redirect (3xx response) to a different origin, the application forwards the original request headers—including Authorization, API credentials, and custom tenant identifiers—to the new location without filtering. An attacker with control or network access to an MCP server endpoint can craft a redirect response pointing to an attacker-controlled origin, causing the client to leak sensitive headers. The issue is classified under CWE-522 (Insufficiently Protected Credentials) due to the unprotected transmission of authentication material.

Business impact

Successful exploitation enables credential compromise, which could lead to unauthorized API access, lateral movement within integrated services, and data exfiltration. For organizations relying on OpenClaw's MCP integrations, a compromised endpoint becomes a vector for stealing production API keys and tenant-specific routing tokens. The impact is amplified in multi-tenant or SaaS deployments where tenant isolation depends on header-based routing. While exploitation requires authenticated access or endpoint compromise, the consequence—wholesale credential theft—justifies immediate patching.

Affected systems

OpenClaw versions prior to 2026.5.12 are affected. Organizations running streamable-http MCP servers should verify their OpenClaw deployment version and patch status immediately. The vulnerability is specific to the MCP server implementation; other OpenClaw components are not directly affected unless they depend on streamable-http functionality.

Exploitability

The vulnerability requires either authenticated access (PR:L per CVSS) or control of an MCP endpoint. An attacker cannot exploit this remotely without at least user-level privileges or network access to MCP infrastructure. However, once those preconditions are met, exploitation is straightforward: crafting a redirect response to an attacker-controlled server will passively capture headers. No user interaction (UI:N) is required—the vulnerability is triggered automatically during redirect handling. The attack surface is limited to organizations exposing MCP endpoints but is highly effective when those endpoints are accessible.

Remediation

Upgrade OpenClaw to version 2026.5.12 or later. This patch version addresses the header-leakage issue by sanitizing custom headers before cross-origin redirects. Organizations should verify the patch version in their environment and test in a non-production context before rolling out to production systems. If immediate patching is not feasible, restrict network access to MCP endpoints and monitor outbound HTTP traffic for unexpected redirect targets.

Patch guidance

Deploy OpenClaw 2026.5.12 or a later release. Check your current version using your deployment's standard package management tools. Apply the patch during a maintenance window, as it may require restarting MCP server processes. Validate the patch by confirming the version string post-deployment and running regression tests on any integrations that rely on MCP server redirects. If your organization uses third-party MCP endpoints, notify those providers to ensure they are also patched.

Detection guidance

Monitor HTTP logs for cross-origin redirect patterns originating from MCP servers, particularly redirects to unexpected external domains. Correlate redirect events with sensitive header presence in request logs. Alert on any redirect responses from MCP infrastructure pointing to domains outside your organization's control. Review MCP server configuration to identify any custom headers that may be forwarded; these should be explicitly whitelisted and excluded from cross-origin redirects. Implement network egress controls to block MCP servers from reaching unauthorized external endpoints.

Why prioritize this

This vulnerability carries a HIGH severity rating (CVSS 7.1) due to the combination of high confidentiality impact (H), partial integrity impact (I:L), and the low barrier to exploitation once an attacker has endpoint access. Credential exfiltration is a critical risk in cloud and API-driven architectures. Although the vulnerability requires authentication or endpoint compromise to trigger, the consequences—wholesale theft of API keys and tenant tokens—justify immediate remediation. Organizations should treat this as a priority patch within one to two weeks of release.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: (1) high confidentiality impact from credential exposure, (2) low attack complexity and no special conditions required once access is gained, (3) requirement for low privileges or endpoint control, reducing but not eliminating risk, and (4) unchanged integrity and availability. The score appropriately captures the severity of header leakage without overstating the initial access barrier. Organizations with exposed or high-value MCP endpoints should consider this a 8+ priority internally.

Frequently asked questions