OpenClaw versions before 2026.7.1 do not properly authorize non-owner users when they use the /mcp set and /mcp unset commands to change MCP configuration. This oversight allows an attacker to persist arbitrary stdio MCP commands that are executed with the OpenClaw process's privileges when the configuration loads. The result is a compromise of host confidentiality, integrity, and availability, effectively giving the attacker remote command execution capabilities on the host. This behavior is a classic example of an authorization bypass, mapped to CWE-862.

The vulnerability affects the OpenClaw product by the OpenClaw vendor. Specifically, any installation running a version earlier than 2026.7.1 is susceptible. No other versions or sub‑products were listed in the advisory.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that at the time of this analysis no widespread exploitation or public exploits were known. An attacker would need to be able to execute the /mcp set or /mcp unset commands, which typically requires local user access or a privilege that allows configuration changes. The lack of a remote network attack vector reduces the attack surface, but once an unauthorized user can invoke those commands they can inject persistent commands that run with full OpenClaw process privileges when the configuration is loaded.