GHSA-9c3v-684m-579c: OpenClaw MCP SSE redirect

Q: Is GHSA-9c3v-684m-579c actively exploited?

No confirmed active exploitation of GHSA-9c3v-684m-579c has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-9c3v-684m-579c?

1) Upgrade openclaw to 2026.6.5 or later, the first patched release. 2) If immediate upgrade isn't possible, disable the affected SSE-redirect-following feature or restrict it to trusted operators only. 3) Avoid sharing a single Gateway instance between mutually untrusted users or trust domains. 4) Keep channel and tool allowlists as narrow as possible to limit blast radius if a token is stolen. 5) For detection, audit Gateway/proxy logs for SSE connections that follow redirects to unexpected or external domains, and review whether Authorization headers are being sent cross-origin. 6) Rotate any credentials/API keys that may have transited the affected feature before patching.

Q: What systems are affected by GHSA-9c3v-684m-579c?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP gateways/tool integrations, multi-tenant agent deployments.

Q: What is the CVSS score for GHSA-9c3v-684m-579c?

GHSA-9c3v-684m-579c has a CVSS v3.1 base score of 6.5 (MEDIUM).

CISO Take

OpenClaw's MCP SSE (Server-Sent Events) transport forwards the caller's Authorization header when it follows a redirect, so a lower-trust user, plugin, or configured input path reachable on a shared Gateway can capture that bearer token and reuse it to invoke tools or persist actions beyond what the original caller was authorized to do. This is a medium-severity issue (CVSS 6.5, confidentiality-only impact — C:H/I:N/A:N) with no public exploit, no Nuclei template, and no CISA KEV listing, so there's no evidence of active exploitation — but openclaw already carries 397 other CVEs and a package risk score of 0/100, and a related incident (AIID #1368) shows attackers actively targeting the openclaw skills ecosystem to exfiltrate credentials, so the underlying trust model is a known soft spot. Exposure depends entirely on configuration: any deployment that shares one Gateway between mutually untrusted users, or exposes the affected feature to lower-trust input, is at risk of authorization-token theft. Patch to 2026.6.5 now; until then, disable the affected SSE-redirect feature or restrict it to trusted operators, and keep channel/tool allowlists narrow. Monitor Gateway logs for outbound redirects to unexpected hosts as a detection signal.

Sources: GitHub Advisory CISA KEV ATLAS

What is the risk?

Medium risk overall. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) shows a network-reachable, low-complexity issue requiring only low privileges and no user interaction, but the impact is confidentiality-only — token/credential exposure, not direct code execution or data destruction. There is no EPSS score, no known public exploit or scanner signature, and the flaw is not in CISA KEV, so likelihood of opportunistic mass exploitation is currently low. The real risk driver is architectural: openclaw operates as an AI agent Gateway that can be shared across users of differing trust levels, and this class of flaw (397 other CVEs recorded in the same package, package risk score 0/100) suggests the project's security maturity is still developing. Organizations running openclaw as a multi-tenant or externally-reachable MCP Gateway should treat this as higher priority than the raw CVSS score implies.

How does the attack unfold?

Initial Access

A lower-trust caller, plugin, or configured input path reaches openclaw's MCP SSE tool endpoint, typically via a shared Gateway.

AML.T0053

Malicious Redirect

The attacker-controlled or compromised endpoint responds to the SSE connection with an HTTP redirect to a server the attacker controls.

Header Leak & Token Theft

openclaw's SSE client forwards the original caller's Authorization header to the redirect target, exposing the bearer token/API key.

AML.T0091.000

Impact — Unauthorized Action Execution

The attacker replays the stolen token to invoke agent tools or persist actions beyond the original caller's authorized scope.

AML.T0098

Initial Access

A lower-trust caller, plugin, or configured input path reaches openclaw's MCP SSE tool endpoint, typically via a shared Gateway.

AML.T0053

Malicious Redirect

The attacker-controlled or compromised endpoint responds to the SSE connection with an HTTP redirect to a server the attacker controls.

Header Leak & Token Theft

openclaw's SSE client forwards the original caller's Authorization header to the redirect target, exposing the bearer token/API key.

AML.T0091.000

Impact — Unauthorized Action Execution

The attacker replays the stolen token to invoke agent tools or persist actions beyond the original caller's authorized scope.

AML.T0098

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	npm	< 2026.6.5	`2026.6.5`
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

1) Upgrade openclaw to 2026.6.5 or later, the first patched release. 2) If immediate upgrade isn't possible, disable the affected SSE-redirect-following feature or restrict it to trusted operators only. 3) Avoid sharing a single Gateway instance between mutually untrusted users or trust domains. 4) Keep channel and tool allowlists as narrow as possible to limit blast radius if a token is stolen. 5) For detection, audit Gateway/proxy logs for SSE connections that follow redirects to unexpected or external domains, and review whether Authorization headers are being sent cross-origin. 6) Rotate any credentials/API keys that may have transited the affected feature before patching.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0091.000 - Application Access Token AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is GHSA-9c3v-684m-579c?

OpenClaw's MCP SSE (Server-Sent Events) transport forwards the caller's Authorization header when it follows a redirect, so a lower-trust user, plugin, or configured input path reachable on a shared Gateway can capture that bearer token and reuse it to invoke tools or persist actions beyond what the original caller was authorized to do. This is a medium-severity issue (CVSS 6.5, confidentiality-only impact — C:H/I:N/A:N) with no public exploit, no Nuclei template, and no CISA KEV listing, so there's no evidence of active exploitation — but openclaw already carries 397 other CVEs and a package risk score of 0/100, and a related incident (AIID #1368) shows attackers actively targeting the openclaw skills ecosystem to exfiltrate credentials, so the underlying trust model is a known soft spot. Exposure depends entirely on configuration: any deployment that shares one Gateway between mutually untrusted users, or exposes the affected feature to lower-trust input, is at risk of authorization-token theft. Patch to 2026.6.5 now; until then, disable the affected SSE-redirect feature or restrict it to trusted operators, and keep channel/tool allowlists narrow. Monitor Gateway logs for outbound redirects to unexpected hosts as a detection signal.

Is GHSA-9c3v-684m-579c actively exploited?

No confirmed active exploitation of GHSA-9c3v-684m-579c has been reported, but organizations should still patch proactively.

How to fix GHSA-9c3v-684m-579c?

1) Upgrade openclaw to 2026.6.5 or later, the first patched release. 2) If immediate upgrade isn't possible, disable the affected SSE-redirect-following feature or restrict it to trusted operators only. 3) Avoid sharing a single Gateway instance between mutually untrusted users or trust domains. 4) Keep channel and tool allowlists as narrow as possible to limit blast radius if a token is stolen. 5) For detection, audit Gateway/proxy logs for SSE connections that follow redirects to unexpected or external domains, and review whether Authorization headers are being sent cross-origin. 6) Rotate any credentials/API keys that may have transited the affected feature before patching.

What systems are affected by GHSA-9c3v-684m-579c?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP gateways/tool integrations, multi-tenant agent deployments.

What is the CVSS score for GHSA-9c3v-684m-579c?

GHSA-9c3v-684m-579c has a CVSS v3.1 base score of 6.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP gateways/tool integrationsmulti-tenant agent deployments

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0091.000 Application Access Token

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

### Summary MCP SSE redirects could forward Authorization headers. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. ### Patched Versions The first stable patched version is `2026.6.5`. ### Mitigations Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Exploitation Scenario

An organization runs openclaw as a shared MCP Gateway serving both a trusted internal automation and a lower-trust integration (e.g., a third-party plugin or an externally-reachable input channel). The lower-trust caller points the Gateway's SSE-based tool connection at an endpoint it controls, or exploits an existing configured path that resolves to one. That endpoint responds with an HTTP redirect to an attacker-controlled server; openclaw's SSE client follows the redirect and forwards the legitimate caller's Authorization header along with it. The attacker now holds a valid bearer token/API key and replays it against the Gateway to invoke tools or persist changes with the authorization level of the original, higher-trust caller — effectively privilege escalation via credential theft rather than a traditional code-execution exploit.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-522 Insufficiently Protected Credentials Primary CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Primary

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.