CVE-2026-62208: Openclaw Auth Bypass Vulnerability

CVE-2026-62208 Overview

CVE-2026-62208 affects OpenClaw versions prior to 2026.6.5. The vulnerability allows the application to forward Authorization headers during Model Context Protocol (MCP) Server-Sent Events (SSE) redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization scope. The issue is classified under CWE-522: Insufficiently Protected Credentials. Impact depends on operator configuration and whether lower-trust input can reach the affected code path.

Critical Impact
Improper handling of Authorization headers during SSE redirects can leak bearer tokens or session credentials to unintended endpoints, enabling privilege escalation and unauthorized actions across trust boundaries.

Affected Products

OpenClaw (Node.js package) versions prior to 2026.6.5
Deployments exposing the MCP SSE redirect feature
Environments where lower-trust callers can reach the affected input path

Discovery Timeline

2026-07-17 - CVE-2026-62208 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-62208

Vulnerability Analysis

The vulnerability resides in OpenClaw's handling of HTTP redirects within the Model Context Protocol Server-Sent Events transport. When the client or server follows a redirect during an SSE exchange, the Authorization header is retained and forwarded to the redirect target. This behavior violates the principle of credential compartmentalization, since redirect targets may reside outside the original trust boundary. An attacker controlling or influencing the redirect destination can capture bearer tokens, API keys, or session credentials carried in the header.

The flaw falls under CWE-522: Insufficiently Protected Credentials. Exploitation requires the affected MCP SSE feature to be enabled and network-reachable by a lower-trust caller.

Root Cause

The root cause is the absence of header stripping logic when OpenClaw processes 3xx responses during MCP SSE sessions. HTTP client libraries commonly require explicit configuration to drop sensitive headers on cross-origin redirects. OpenClaw versions before 2026.6.5 did not enforce this safeguard, leaving credentials attached to redirected requests regardless of destination.

Attack Vector

An attacker who can influence redirect responses served to an OpenClaw MCP SSE client, or who operates a lower-trust endpoint reachable via the configured input path, can receive the forwarded Authorization header. The captured credential can then be replayed against the original service to execute or persist actions beyond the caller's intended authorization. The attack requires network access and low privileges but no user interaction.

No verified public proof-of-concept code is available. Refer to the VulnCheck Security Advisory and the GitHub Security Advisory GHSA-9c3v-684m-579c for further technical detail.

Detection Methods for CVE-2026-62208

Indicators of Compromise

Outbound HTTP requests from OpenClaw hosts carrying Authorization headers to unexpected or external domains following a 3xx redirect.
SSE session logs showing redirects to hosts outside the configured MCP trust boundary.
Reuse of bearer tokens or API keys from IP addresses or user agents inconsistent with the legitimate OpenClaw client.

Detection Strategies

Inspect egress proxy or web application firewall logs for Authorization headers sent to domains other than the expected MCP endpoint.
Correlate SSE redirect events with subsequent authenticated requests from unfamiliar sources to identify token replay.
Audit OpenClaw configuration to enumerate every input path that can trigger MCP SSE redirects and validate their trust level.

Monitoring Recommendations

Enable verbose HTTP client logging on OpenClaw to record redirect chains and header propagation.
Alert on any redirect from the MCP SSE endpoint to a host not on an allow-list of internal services.
Rotate any credentials that may have been forwarded and monitor authentication logs for anomalous use.

How to Mitigate CVE-2026-62208

Immediate Actions Required

Upgrade OpenClaw to version 2026.6.5 or later, which strips Authorization headers on redirect.
Rotate all bearer tokens, API keys, and session credentials that may have transited MCP SSE sessions on affected versions.
Restrict network reachability of the MCP SSE endpoint to trusted callers only until patching is complete.

Patch Information

Upgrade to OpenClaw 2026.6.5 or later. The maintainers published fix details in the GitHub Security Advisory GHSA-9c3v-684m-579c. Additional analysis is available in the VulnCheck Security Advisory.

Workarounds

Disable the MCP SSE feature if it is not required in your deployment.
Place an egress proxy in front of OpenClaw that strips Authorization headers on cross-origin redirects.
Enforce strict allow-lists on outbound destinations reachable from the OpenClaw process to prevent credentials leaking to untrusted hosts.

bash

# Upgrade OpenClaw to the patched release
npm install openclaw@2026.6.5

# Verify the installed version
npm ls openclaw