Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.12 in the streamable-http MCP servers. It causes operator-configured custom headers to be forwarded during cross-origin redirects. If an attacker controls or compromises an MCP endpoint, they can redirect requests to attacker-controlled origins and exfiltrate sensitive headers such as API keys or tenant-routing credentials.

The issue arises when the MCP server responds with a cross-origin redirect, unintentionally sending sensitive custom headers to unauthorized external origins.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of sensitive information such as API keys and tenant-routing credentials to attackers who control or compromise an MCP endpoint.

Such exposure can allow attackers to misuse these credentials, potentially gaining unauthorized access to systems or data, leading to confidentiality breaches.

The impact is rated high in terms of confidentiality, though it has low impact on integrity and no impact on availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when an MCP server configured with transportType "streamable-http" forwards operator-configured custom headers during cross-origin redirects. Detection involves monitoring network traffic for unexpected cross-origin redirects that include sensitive custom headers such as API keys or tenant-routing credentials.

You can inspect HTTP traffic to identify if custom headers are being forwarded during redirects to untrusted origins. For example, using tools like tcpdump or Wireshark to capture HTTP requests and responses, then filtering for redirect status codes (3xx) and examining headers.

• Use tcpdump to capture HTTP traffic on the MCP server port: tcpdump -i <interface> -A 'tcp port <MCP_port>'
• Filter HTTP responses with redirect status codes (e.g., 301, 302) and check for presence of custom headers in requests following redirects.
• Use curl with verbose output to manually test endpoints for cross-origin redirects and header forwarding: curl -v -L <MCP_endpoint_URL>

Additionally, review the MCP server configuration for transportType set to "streamable-http" and check the headers configured under mcp.servers.*.headers to identify sensitive headers that could be exposed.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade OpenClaw to version 2026.5.12 or later, as this version contains the patch that fixes the issue.

Avoid configuring custom MCP headers with untrusted or potentially compromised MCP endpoints to prevent sensitive headers from being forwarded during cross-origin redirects.

Rotate any credentials, such as API keys or tenant-routing credentials, that may have been exposed due to this vulnerability.

Useful 0 Not Useful 0