CVE-2026-100596 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integrity, and availability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions prior to 2026.7.1 represents a critical failure in access control mechanisms within the application's Model Context Protocol (MCP) configuration subsystem. Specifically, the software fails to enforce proper authorization checks when non-owner users attempt to modify MCP configurations via the /mcp set and /mcp unset commands. This flaw allows any authenticated user with write access to the chat interface or API endpoints associated with these commands to inject arbitrary stdio-based MCP server definitions into the application's configuration state. The core technical deficiency lies in the absence of a privilege escalation check that verifies whether the initiating user possesses administrative privileges or ownership rights over the specific workspace, bot instance, or global configuration context being modified. By bypassing this authorization layer, an attacker can effectively alter how OpenClaw interacts with external tools and services during runtime initialization phases.
The operational impact of this vulnerability is severe due to the execution context in which these configurations are processed. When OpenClaw loads its MCP configuration, it initializes connections to defined stdio servers, often spawning subprocesses or establishing communication channels that inherit the privileges of the main application process. If an attacker successfully injects a malicious stdio command through the /mcp set endpoint, this command will execute with the same high-level permissions as the OpenClaw service itself. This typically includes read and write access to sensitive files, network connectivity to internal services, and potentially shell execution capabilities depending on how the MCP server is implemented by third-party developers or integrated tools. Consequently, an attacker can achieve remote code execution (RCE) within the host environment without needing elevated credentials for the underlying operating system, effectively compromising the confidentiality of proprietary data processed by the AI agent, the integrity of the application's logic and outputs, and the availability of the service through resource exhaustion or destructive commands.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Escalation, as it involves an actor gaining capabilities beyond their intended permissions. It also maps to ATT&CK technique T1059 Command and Scripting Interpreter, specifically regarding the abuse of system utilities via stdio interfaces, and potentially T1136 Create Account if used for persistence mechanisms within the application's configuration store. The attack vector is primarily remote if OpenClaw exposes these endpoints over a network interface, making it accessible to external adversaries who have valid authentication credentials or can exploit other vulnerabilities to gain initial access. Even in local-only deployments, any user account with limited privileges could leverage this flaw to escalate their influence within the system boundary defined by the application's runtime environment.
Mitigation strategies must focus on immediate remediation and long-term architectural hardening. The primary solution is to upgrade OpenClaw to version 2026.7.1 or later, where the authorization logic for /mcp set and /mcp unset commands has been corrected to strictly verify user ownership or administrative role before allowing configuration changes. For environments unable to patch immediately, administrators should restrict network access to these specific API endpoints using firewall rules or reverse proxy configurations that limit exposure to trusted internal networks only. Additionally, implementing strict input validation on MCP server definitions can help prevent the injection of malicious stdio commands by sanitizing command strings and restricting allowed executables to a predefined whitelist. Enforcing principle of least privilege for the OpenClaw process itself is also critical; running the application under a dedicated service account with minimal file system and network permissions reduces the blast radius should such an exploit be successfully executed in unpatched systems. Regular auditing of configuration changes through logging mechanisms can further aid in detecting unauthorized modification attempts before they result in full compromise.