CVE-2026-44118: OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header
OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44118?
CVE-2026-44118 is rated as a high severity vulnerability due to the potential for owner context spoofing.
How do I fix CVE-2026-44118?
To fix CVE-2026-44118, upgrade to OpenClaw version 2026.4.22 or later.
What is CVE-2026-44118?
CVE-2026-44118 is a vulnerability in OpenClaw that allows non-owner loopback clients to spoof owner context through bearer token headers.
Who is affected by CVE-2026-44118?
Any users of OpenClaw versions prior to 2026.4.22 are affected by CVE-2026-44118.
What are the consequences of CVE-2026-44118?
CVE-2026-44118 can lead to unauthorized access to owner-gated operations, resulting in data breaches or misuse of permissions.