Description
OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can obtain a standalone ticket from mcp.app.view and redeem it at the MCP app view endpoint to invoke state-changing tools without proper authorization checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.9.4 | 2026.9.4 |
Advisories 1
- WID-SEC-2026-3673 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 29, 2026
References
- Pull Request #142661 issue-tracking patch
- Patch Commit patch
- https://github.com/openclaw/openclaw/blob/1391f7cd2d40ab5bbcf2f5f831d3a64f520e72d7/src/gateway/mcp-app-standalone.ts#L209-L215 technical-description
- https://docs.openclaw.ai/releases/2026.9.4 release-notes
- https://github.com/openclaw/openclaw product
- VulnCheck Advisory: OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket third-party-advisory