Threats tagged 'ghsa-rj6p-xmxr-qj4h'

A vulnerability in OpenClaw CLI's MCP loopback feature allows non-owner callers to bypass owner-only tool policies and before-tool-call hooks. This issue affects versions from 2026.1.29 up to but not including 2026.4.24. The impact depends on the operator's configuration and whether untrusted inputs can reach the affected loopback path. A patch is available to address this issue. Until patched, restricting MCP loopback access to trusted operators and narrowing allowlists is recommended.