Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🔴 OpenClaw, Information Exposure via Cross-Origin Redirect, #CVE-2026-53840 (High) -DC-Jul2026-818 https://dailycve.com/openclaw-information-exposure-via-cross-origin-redirect-cve-2026-53840-high-dc-jul2026-818/
Post summary
The text announces CVE-2026-53840, a high‑severity information exposure flaw in OpenClaw caused by cross‑origin redirects, without providing exploit code or patch details.
9 of 9 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |
| App | openclaw | openclaw | 2026.5.12 | node.js | - |