Summary
OpenClaw does not properly authorize non-owner users who invoke MCP configuration changes through the /mcp set and /mcp unset commands. An attacker with access to those command interfaces may persist arbitrary stdio MCP commands that execute with OpenClaw's process privileges when the configuration is loaded.
Affected context
The vulnerability occurs in OpenClaw deployments where non-owner users can access MCP configuration commands and the resulting configuration is later loaded by the OpenClaw process. It is relevant when authorization checks do not consistently restrict configuration changes to trusted administrative identities, particularly in versions before the authorization behavior was corrected.
Exploit preconditions
- Attack surface: OpenClaw MCP configuration command handlers
- Required access: A non-owner account or user context able to invoke
/mcp setor/mcp unset - Trigger point: Loading or starting the configured MCP command
- Why exploitation is possible: Authorization is insufficiently enforced before accepting persistent MCP configuration changes, allowing attacker-controlled commands to run with OpenClaw process privileges
Why this happens
The underlying issue is an authorization failure in a security-sensitive configuration management path. OpenClaw permits a user who is not the designated owner to modify MCP command definitions, and those definitions are subsequently trusted during configuration loading. This behavior maps to CWE-862: Missing Authorization, because the application does not reliably verify that the requesting identity has permission to perform the protected operation.
Potential impact
- An attacker may execute arbitrary commands with OpenClaw process privileges
- Host confidentiality could be compromised through access to local files or secrets
- Host integrity may be affected through unauthorized modification of data or configuration
- Service availability could be disrupted
- Persistent malicious MCP configuration could enable repeated execution or lateral movement
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every MCP configuration mutation boundary and reducing the trust placed in persisted command definitions.
Common defensive patterns include:
- Restricting
/mcp setand/mcp unsetoperations to explicitly authorized owner or administrator identities - Applying deny-by-default authorization policies to configuration-management commands
- Requiring independent authorization checks when persisted MCP configuration is loaded or activated
- Allowing only approved, schema-validated MCP command definitions rather than arbitrary stdio commands
- Running OpenClaw with the least privileges needed and isolating it from sensitive host resources
- Auditing and protecting MCP configuration storage against unauthorized modification
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks confirming authorization before every configuration mutation
- Tests that exercise MCP commands as owner, non-owner, unauthenticated, and downgraded-privilege users
- Review of command handlers for missing ownership checks, inconsistent policy enforcement, or authorization performed after state changes
- Runtime monitoring for unexpected
/mcp setand/mcp unsetactivity or newly persisted stdio commands - Policy enforcement that limits executable MCP definitions and alerts on configuration changes outside approved workflows
- Automated security review tools that identify protected operations lacking consistent authorization controls
