CVE-2026-62208: OpenClaw Auth header leak

CISO Take

OpenClaw's MCP client followed HTTP redirects during Server-Sent Events (SSE) sessions and re-sent the original Authorization header to the redirect target, effectively forwarding a caller's credentials to a destination the caller never authorized. This CVE carries a medium CVSS of 6.5 (high confidentiality impact, no integrity or availability loss), and there's no public exploit, EPSS score, or CISA KEV listing yet — but the flaw sits squarely in agent-to-tool trust boundaries, exactly the kind of confused-deputy bug that turns a low-trust MCP tool or input path into a privilege escalation vector. Impact is highly configuration-dependent: it only matters if the affected redirect-following feature is enabled and reachable by lower-trust callers or inputs, so exposure varies widely across OpenClaw deployments. CISOs running OpenClaw-based agents should confirm whether any MCP SSE integrations can reach attacker-influenced redirect targets and treat this as a priority patch even without active exploitation, given how directly it undermines authorization boundaries in agentic workflows. Patch to OpenClaw 2026.6.5 or later and review MCP SSE configurations for redirect-capable, lower-trust input paths.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 6.5) with high confidentiality impact and no integrity or availability impact. Network-exploitable with low attack complexity and low privileges required, no user interaction needed — but real-world exploitability is gated entirely by operator configuration: the affected SSE redirect-forwarding behavior must be enabled and reachable by a lower-trust caller or configured input path. No public exploit code, no EPSS score, and not in CISA KEV, so current exploitation likelihood appears low. However, the underlying flaw (forwarding auth credentials across a redirect) is a well-understood web security anti-pattern that is trivial to weaponize once a reachable path is identified, so the risk should not be discounted long-term.

How does the attack unfold?

Redirect Setup

Attacker positions a malicious or compromised endpoint that a lower-trust MCP tool or input path can cause the OpenClaw agent to contact, and configures it to return an HTTP redirect.

AML.T0053

Header Forwarding

OpenClaw's MCP SSE client follows the redirect and re-sends the original Authorization header to the attacker-controlled destination.

AML.T0091.000

Credential Harvesting

The attacker captures the forwarded Authorization token from their server's access logs.

AML.T0098

Unauthorized Action

The attacker replays the harvested token to execute or persist actions on the legitimate MCP service beyond the original caller's intended authorization.

AML.T0012

Redirect Setup

Attacker positions a malicious or compromised endpoint that a lower-trust MCP tool or input path can cause the OpenClaw agent to contact, and configures it to return an HTTP redirect.

AML.T0053

Header Forwarding

OpenClaw's MCP SSE client follows the redirect and re-sends the original Authorization header to the attacker-controlled destination.

AML.T0091.000

Credential Harvesting

The attacker captures the forwarded Authorization token from their server's access logs.

AML.T0098

Unauthorized Action

The attacker replays the harvested token to execute or persist actions on the legitimate MCP service beyond the original caller's intended authorization.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade OpenClaw to version 2026.6.5 or later, which stops forwarding Authorization headers across SSE redirects. If immediate patching isn't possible, audit MCP tool/server configurations to identify any redirect-capable endpoints reachable by lower-trust input paths and disable or restrict them. Enforce an allowlist of trusted MCP SSE origins and strip Authorization headers on cross-origin redirects at a network/proxy layer as a compensating control. For detection, review access/audit logs for MCP SSE connections for redirects to unexpected hosts and for Authorization headers appearing at endpoints the caller did not directly configure.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0091.000 - Application Access Token AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-62208?

OpenClaw's MCP client followed HTTP redirects during Server-Sent Events (SSE) sessions and re-sent the original Authorization header to the redirect target, effectively forwarding a caller's credentials to a destination the caller never authorized. This CVE carries a medium CVSS of 6.5 (high confidentiality impact, no integrity or availability loss), and there's no public exploit, EPSS score, or CISA KEV listing yet — but the flaw sits squarely in agent-to-tool trust boundaries, exactly the kind of confused-deputy bug that turns a low-trust MCP tool or input path into a privilege escalation vector. Impact is highly configuration-dependent: it only matters if the affected redirect-following feature is enabled and reachable by lower-trust callers or inputs, so exposure varies widely across OpenClaw deployments. CISOs running OpenClaw-based agents should confirm whether any MCP SSE integrations can reach attacker-influenced redirect targets and treat this as a priority patch even without active exploitation, given how directly it undermines authorization boundaries in agentic workflows. Patch to OpenClaw 2026.6.5 or later and review MCP SSE configurations for redirect-capable, lower-trust input paths.

Is CVE-2026-62208 actively exploited?

No confirmed active exploitation of CVE-2026-62208 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62208?

Upgrade OpenClaw to version 2026.6.5 or later, which stops forwarding Authorization headers across SSE redirects. If immediate patching isn't possible, audit MCP tool/server configurations to identify any redirect-capable endpoints reachable by lower-trust input paths and disable or restrict them. Enforce an allowlist of trusted MCP SSE origins and strip Authorization headers on cross-origin redirects at a network/proxy layer as a compensating control. For detection, review access/audit logs for MCP SSE connections for redirects to unexpected hosts and for Authorization headers appearing at endpoints the caller did not directly configure.

What systems are affected by CVE-2026-62208?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, multi-agent orchestration.

What is the CVSS score for CVE-2026-62208?

CVE-2026-62208 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationsmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0091.000 Application Access Token

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

Exploitation Scenario

An operator configures an OpenClaw agent with a legitimate MCP tool, but also exposes a path where lower-trust input (e.g., a user-supplied URL, a third-party plugin, or content ingested by the agent) can influence which MCP SSE endpoint gets contacted. An attacker plants or controls an endpoint that responds to the initial SSE request with an HTTP redirect to a server they control. OpenClaw's MCP client follows the redirect and re-sends the original Authorization header to the attacker's server, leaking the caller's credential/token. The attacker replays that token against the legitimate MCP service to execute or persist actions the original caller never intended to authorize — a confused-deputy privilege escalation within the agent's tool-invocation chain.

Weaknesses (CWE)

CWE-522 Insufficiently Protected Credentials Primary CWE-522 Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.