https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T02:10:08.060586+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-53840 CVE-2026-53840 — OpenClaw < 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirects 2026-09-29T02:10:08.564005+00:00

Affected: OpenClaw

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.

 https://vulnerability.circl.lu/vuln/ghsa-rjxq-qqhf-8hwh GHSA-rjxq-qqhf-8hwh — OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin 2026-09-29T02:10:08.564168+00:00

Affected: npm: openclaw

### Summary

OpenClaw supports remote MCP Streamable HTTP servers with operator-configured custom headers. In affected releases, those headers could be forwarded when the MCP endpoint responded with a cross-origin redirect.

This issue is limited to configured MCP Streamable HTTP servers that use custom headers. It does not expose unrelated OpenClaw credentials.

### Affected configurations

This affects deployments where an MCP server is configured with:

- `transportType: "streamable-http"` - sensitive custom headers under `mcp.servers.*.headers` - an MCP endpoint that is malicious, compromised, or able to redirect to another origin

### Impact

Custom MCP headers, such as API keys or tenant-routing headers, could be sent to the redirect target. The exposed credential scope depends on the header the operator configured for that MCP server.

### Patched Versions

The first stable patched version is `2026.5.12`.

### Mitigations

Upgrade to `openclaw@2026.5.8` or later. Before upgrading, avoid custom MCP headers with servers you do not fully trust, and rotate any MCP-specific credentials that may have been exposed by a redirecting endpoint.