OpenClaw contains a vulnerability in its bundled MCP loopback feature where the execution denylist may be bypassed during session spawn. This allows a caller with access to the affected session-spawn path to start a session with broader command execution capabilities than intended. The issue affects versions prior to 2026.5.12. The vulnerability does not alter OpenClaw's trusted-operator model but could be exploited if lower-trust input reaches the vulnerable path. Mitigation involves restricting access to trusted operators and applying the patch in version 2026.5.12.