CVE-2026-53840

Published: Jun 16, 2026Modified: Jun 17, 2026

6.0

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.

Affected (9)

Products: Openclaw: Openclaw

Openclaw

1 product

Openclaw

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Openclaw Openclaw	Before 2026.5.12
Openclaw Openclaw	Version 2026.5.12 beta1
Openclaw Openclaw	Version 2026.5.12 beta2
Openclaw Openclaw	Version 2026.5.12 beta3
Openclaw Openclaw	Version 2026.5.12 beta4
Openclaw Openclaw	Version 2026.5.12 beta5
Openclaw Openclaw	Version 2026.5.12 beta6
Openclaw Openclaw	Version 2026.5.12 beta7
Openclaw Openclaw	Version 2026.5.12 beta8

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://github.com/openclaw/openclaw/security/advisories/GHSA-rjxq-qqhf-8hwh

Source: disclosure@vulncheck.com

Vendor Advisory

https://www.vulncheck.com/advisories/openclaw-custom-header-leakage-via-mcp-streamable-http-cross-origin-redirects

Source: disclosure@vulncheck.com

Third Party Advisory

Timeline

No history available yet.