Information disclosure in OpenClaw - #VU132708
Published: May 29, 2026
Vulnerability identifier: #VU132708
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in MCP Streamable HTTP redirect handling when processing cross-origin redirects from a configured MCP endpoint. A remote user can cause a malicious or compromised MCP endpoint to redirect to another origin to disclose sensitive information.
This issue is limited to MCP Streamable HTTP servers configured with custom headers, and the exposed data is limited to those configured headers.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.5.12