Vulnerability intelligence
CVE-2026-44118
OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.
CVSS Score
8.5
High
EPSS — Exploit Probability
0.1%
Riskier than 2% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
3 articles across 3 outlets · first covered May 15, 2026 · latest May 18, 2026
Coverage timeline
-
OpenClaw bugs enable full system takeover via chained exploitswww.darkreading.com · May 18, 2026
-
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Deliverywww.securityweek.com · May 18, 2026
-
OpenClaw chain lets attackers hijack config and steal datathehackernews.com · May 15, 2026