GHSA-r6xh-pqhr-v4xh: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

May 4, 2026

MCP loopback owner context is derived from server-issued bearer tokens.

References

github.com/advisories/GHSA-r6xh-pqhr-v4xh
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/3cb1a56bfc9579a0f2336f9cfa12a8a744332a19
github.com/openclaw/openclaw/security/advisories/GHSA-r6xh-pqhr-v4xh

Code Behaviors & Features

Detect and mitigate GHSA-r6xh-pqhr-v4xh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →