Disclosed weakness · no CVE recorded

OpenClaw could retain an MCP tool grant after a CLI turn ended

OpenClaw · OpenClaw Gateway warm CLI turn grants

First documented disclosure · Review checkpoint

Summary

When the Gateway reused a CLI process, an MCP grant issued for a completed turn could remain active.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documented the defect and its repair. The reviewed sources identify no malicious use.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The grant had moved to the reused process credential before the cleanup for the original turn ran.

Conditions required

A Gateway reuses a CLI process for turns with MCP tool access.

Potential impact

A grant intended to last for one turn could remain available beyond that turn’s authorization period.

Affected versions and configurations

The project has not published a complete affected version range.

Fix and mitigation status

OpenClaw 2026.11.2 includes the fix. The exact first fixed release across all release lines is unverified.

Practical next steps

Update OpenClaw and end old reusable sessions when withdrawing tool access.

Operating lesson

Bind revocation to the grant’s lifetime even when multiple turns share a process.

Evidence and limits

The repair tracks the grant through transfer and prevents delayed cleanup from revoking a newer turn’s grant. The maintainer reports harness checks and explicitly notes limits on pre-fix testing.

Sources