Openclaw cli: OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn (CVE-2026-53820)

The bundled MCP loopback in OpenClaw CLI could miss applying its execution denylist on session spawn, allowing a caller with access to this session-spawn path to bypass intended command restrictions. This vulnerability affects versions >=2026.1.29 and <2026.5.12. The impact depends on operator configuration and whether lower-trust inputs can reach the vulnerable path. The trusted-operator model remains unchanged, meaning authenticated Gateway operators and installed plugins are still trusted unless additional policies or boundaries are crossed. The issue is fixed in version 2026.5.12.

When the affected feature is enabled and accessible, an attacker or caller could start a session with broader command execution capabilities than intended by the denylist. The practical impact depends on the specific operator configuration and whether untrusted inputs can reach the vulnerable session-spawn path. This could lead to unauthorized command execution within the scope of the MCP loopback session.

A patch is available in version 2026.5.12 and should be applied to remediate this vulnerability. Until patched, restrict bundled MCP loopback access strictly to trusted operators. Additionally, narrow channel and tool allowlists, avoid sharing a Gateway between mutually untrusted users, and disable the affected feature if it is not needed.