OpenClaw approval/tooling and MCP memory document-boundary checks¶

Source: hourly offensive-security scan, 2026-07-02. Primary entries: GitHub Advisory Database GHSA-hw9r-h9mr-4jff, GHSA-mhq8-78pj-5j79, GHSA-mgq6-vr84-7m2j, GHSA-6fvr-66p3-3qj4 / CVE-2026-53814, GHSA-chr9-m4q2-76hw / CVE-2026-53817, GHSA-rggc-m335-3wvj, GHSA-v6r2-jh58-xx6w / CVE-2026-53810, GHSA-2hfg-4fh4-qp7f / CVE-2026-53812, GHSA-2j8v-hwgc-x698, GHSA-qh2f-99mv-mrcf, GHSA-xww8-gqvh-92x9, GHSA-q7q8-3mgw-q67r / CVE-2026-53815, and GHSA-84hp-mqvj-3p8h / CVE-2026-50027.

These advisories are durable for operators because they repeat the same agent-platform boundary failures across different surfaces: a displayed or scoped action diverges from the action that actually executes, channel/tool allowlists are not consistently applied to alternate routes, browser or hook automation crosses into private-network or owner-only authority, and memory/document APIs skip authentication on adjacent route families. Keep validation to owned labs, disposable profiles, fake memories, inert commands, canary channels, and synthetic node files only.

What changed¶

July 2 follow-up wave: identity, pairing, loopback, and workspace-state drift¶

Adjacent OpenClaw advisories published later on July 2 continue the same operator pattern: mutable chat metadata, stale chat tokens, provider aliases, package-root discovery, workspace .env, Control UI WebSockets, node lifecycle messages, browser tab reuse, and skill-workshop approval state can all become alternate authority paths. Treat these as follow-up checks on this page instead of separate alerts.

Operator triage¶

1. Draw the agent authority graph. Inventory every way an action can enter the platform: Gateway API, chat bridge, native approval widget, hook endpoint, browser action, MCP loopback, proxy-facing port, marketplace install path, and memory API.
2. Compare intent, display, approval, and execution. For command execution, preserve the original request, displayed approval text, post-expansion argv, environment, working directory, and final process invocation. A mismatch is the finding.
3. Test alternate routes with lower-trust identities. Use a scoped Gateway token, non-approver chat identity, hook token, same-host local caller, or unauthenticated document client only in a lab. Confirm whether each path reaches the same guard as the primary path.
4. Keep canaries inert. Prefer printf/id-free marker commands, fake MCP tools, disposable memory documents, synthetic channels, and local files containing only marker text. Do not read real prompts, chat history, credentials, notebooks, node configs, or production memories.
5. Separate auth bypass from trusted-operator behavior. Many OpenClaw surfaces intentionally execute privileged local actions for trusted operators. Report only where a lower-trust route crosses a documented approval, scope, allowlist, locality, proxy, or authentication boundary.
6. Treat repo-local state as an agent input. For skill install, memory-core loading, child sessions, and embedded runners, record whether workspace .env, package roots, provider aliases, or prompt context influence privileged helper behavior.
7. Normalize before allowlisting. For retry endpoints and Windows shell wrappers, compare final parsed URL authorities and final PowerShell option aliases against policy, not the pre-normalized presentation string.

Replayable validation boundaries¶

OpenClaw scope and channel-route drift¶

• Preconditions: disposable OpenClaw lab, affected version, one scoped Gateway client with only the documented lower privilege, synthetic chat/session routes, and a harmless admin-like canary action such as writing a marker key in a throwaway config namespace.
• Send the same command through the normal path and through the inherited external route or message-read action under test.
• Positive evidence: the lower-scoped caller resolves approval/admin behavior or reads a disallowed channel through the alternate path while the normal path rejects it.
• Negative controls: fixed OpenClaw version, a client lacking operator.write, and a session without inherited external delivery routes.
• Do not test with real operator channels, production plugin/config state, or real user messages.

Approval integrity and argv-finalization checks¶

• Preconditions: disposable POSIX node or local runner, affected version, exec approval enabled, and commands constrained to inert marker operations.
• Capture four artifacts for each candidate command: requested string, approval UI rendering, policy decision input, and final argv/process trace.
• Exercise long-command truncation, shell-wrapper rebuilds, and safe-bin arguments containing shell-expanded values in a temp directory with marker-only files.
• Positive evidence: the command that runs differs materially from the command shown or checked, or an allowlisted command gains an unintended file operand after expansion.
• Negative controls: fixed version, commands below truncation thresholds, explicit approval with full immutable argv, and policy evaluation after expansion.
• Never hide destructive suffixes, read sensitive files, or execute payloads beyond marker creation in a temp directory.

Chat-native approval callback checks¶

• Preconditions: lab QQBot integration, native approval buttons enabled, one configured approver, one non-approver account that can see a synthetic approval message, and a harmless pending action.
• Confirm text-command approval rejects the non-approver.
• Attempt the native button callback from the non-approver account.
• Positive evidence: the native button resolves the approval while the text path rejects the same identity.
• Negative controls: fixed version, approval message visible only to the configured approver, and a pending action that is already expired or canceled.
• Do not place approval buttons for real exec/plugin actions in shared chats.

Native command, PowerShell, retry endpoint, and Telegram callback checks¶

• Preconditions: disposable OpenClaw lab, affected versions, synthetic owner-only/native commands, fake retry credentials, one non-owner chat identity, Telegram callbacks enabled only in a lab, and a Windows/PowerShell runner only if that surface is in scope.
• Native commands: compare the canonical text/Gateway route and the native command handler using a non-owner sender. Positive evidence is owner-command behavior reachable only through the native path.
• PowerShell encoded commands: build a decision table for canonical and abbreviated encoded-command flags. Capture the displayed command, policy input, normalized PowerShell argv, and final decision using only inert marker commands.
• Trusted retry endpoints: configure a fake trusted origin and attempt owned prefix-confusion hosts such as trusted.example.attacker.invalid or trusted.example-evidence.invalid. Positive evidence is fake auth material sent to the prefix-confusion endpoint.
• Telegram callbacks: verify a non-allowed Telegram identity cannot trigger the equivalent text command, then attempt the interactive callback. Positive evidence is callback execution before commands.allowFrom rejection.
• Negative controls: patched OpenClaw versions, exact URL authority checks, final argv/option normalization before allowlist decisions, and callback authorization that uses stable Telegram user/chat IDs before any trusted-sender flag is set.
• Never use live operator chats, real Gateway tokens, production retry endpoints, or PowerShell payloads beyond marker creation.

Hook, MCP loopback, and memory API boundary checks¶

• Preconditions: disposable OpenClaw or mcp-memory-service lab, fake API keys/tokens, and test-only MCP tools/documents.
• For OpenClaw hooks, trigger a run with a hook token and select the bundled CLI backend under test; record which MCP tools are visible compared with an owner session and a restricted session.
• For bundled MCP loopback, attempt session spawn through each transport/path and compare the effective exec denylist with the expected denylist.
• For mcp-memory-service, call /api/memories and /api/documents/* with and without credentials using marker-only documents. Test upload, history/search, and delete in an empty store.
• Positive evidence: hook-triggered or loopback sessions gain owner-only tools/exec capabilities, or unauthenticated document routes can write/read/delete while the corresponding memory routes require auth.
• Negative controls: patched OpenClaw or mcp-memory-service, hooks disabled, no bundled CLI backend, denylist enforced at spawn, and document routes returning authentication failures.
• Never expose real memory stores, collect user memories, trigger production cron/tool actions, or delete non-test documents.

Browser action and trusted-proxy locality checks¶

• Preconditions: lab browser-control instance, owned redirect/canary page, synthetic private web service, and a proxy/topology you control.
• Browser control: verify direct navigation to a private-network canary is blocked; then load an allowed page where a click/action causes navigation to the same private canary. Evaluate only a marker string from the canary page.
• Trusted proxy: verify the Gateway backend port cannot be reached directly except from the actual proxy; if same-host direct access is intentionally possible, send fake identity headers and compare the resolved operator identity.
• Control UI pairing: from a temporary/shared-token client, test whether spoofed locality signals can create a durable paired device; record only device IDs and role decisions from the lab.
• Positive evidence: action-triggered navigation bypasses the private-network guard, direct same-host headers are trusted as proxy identity, or temporary UI access persists as admin pairing.
• Negative controls: patched version, backend bound only to the proxy interface, explicit proxy header stripping, and pairing that requires cryptographic device proof rather than locality alone.
• Do not browse internal production services, capture pages with secrets, or mint durable tokens outside an owned lab.

Marketplace extension metadata checks¶

• Preconditions: isolated OpenClaw marketplace/plugin lab, inert extension package, and a marker payload that only logs or writes inside a temp directory.
• Build a package where visible metadata points to reviewed content while runtime metadata attempts to load a hidden or alternate entry point.
• Positive evidence: installation or runtime loading executes the alternate content that the scanner/review path did not inspect.
• Negative controls: fixed version, package allowlist requiring immutable digests, scanner resolving the same metadata as runtime, and runtime refusing out-of-manifest paths.
• Do not install untrusted marketplace packages on production gateways or run payloads beyond marker-only code.

July 31 transcript-to-dashboard rendering follow-up¶

GHSA-hc44-65x2-rvc2 / CVE-2026-66421 reports that unauthenticated agent transcript messages reached the OpenClaw Dashboard landing page through unsanitized innerHTML, including within a 60-character rendering budget. The GitHub Advisory Database entry was unreviewed at scan time, so confirm the exact artifact, sessions API route, and render implementation before treating the affected path as established.

The durable boundary is lower-trust transcript producer -> stored session message -> privileged same-origin dashboard DOM. Test storage and rendering separately:

1. Deploy the affected candidate build with a disposable administrator, no real agents or tools, fake session tokens, and browser APIs instrumented to block network, navigation, storage reads, and privileged API calls.
2. Submit a unique plain-text transcript marker through the sessions API as the lowest-trust supported caller. Record authentication state, route, stored representation, session ID hash, and whether the marker appears on the default landing page.
3. Replace executable markup with a harmless event-shaped DOM canary whose handler is rewritten by the test harness to increment an in-memory counter only. Keep the complete fixture within the advisory's stated rendering budget; do not read cookies or invoke admin endpoints.
4. Capture input bytes, stored bytes, generated HTML, DOM nodes before and after parsing, sanitizer/template decisions, and counter value. Compare escaped text, ordinary HTML, malformed tags, alternate transcript fields, direct session views, and the landing-page summary.
5. Repeat on the corrected artifact when identified. The lower-trust marker may remain visible as text, but it must not create active attributes/elements or trigger the recorder.

A bounded positive is unauthenticated or lower-trust sessions API message -> persisted transcript -> landing-page innerHTML creates an active DOM node -> inert recorder fires. Do not collect session tokens, modify instruction files, call live administrative APIs, or claim agent takeover from storage alone.

Reporting notes¶

• Lead with the crossed boundary: scoped route to admin command, approval display to hidden execution, hook token to owner MCP tools, native approval widget to approver identity, browser action to private-network read, proxy/locality signal to operator identity, transcript storage to privileged dashboard DOM, or unauthenticated documents route to memory read/write/delete.
• Include version, feature flags, identity used, exact route/transport, positive/negative decision table, and sanitized canary values.
• Avoid broad claims such as “agent takeover” unless the tested deployment proves a lower-trust principal can reach a real high-impact tool or state transition.