Skip to content

v0.8.31 — MCP loopback session-spawn exec-resolution guard (CVE-2026-53820)

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 21 Jun 15:35
v0.8.31
cbd29b6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

Add runtime preset for CVE-2026-53820 (OpenClaw exec-denylist bypass at MCP loopback session-spawn)

OpenClaw < 2026.5.12 (exec-denylist bypass, CVSS 6.9, CWE-693 Protection Mechanism Failure): the bundled MCP loopback session-spawn path let an authenticated caller reach a denylisted command because the surface command checked against the exec restriction differs from the effective command actually spawned — a name that passes the surface check resolves, via an alias / wrapper binary (env / sudo / timeout / nice / …) / shell, to a denied executable. Bypass at the spawn boundary, not config time.

  • LoopbackSessionSpawnGuard (mcp_spec/loopback_spawn_guard.py): check_spawn(command) unwraps aliases + wrapper binaries to the effective program and re-checks it deny-by-default — a resolved shell / denylisted exec is refused, and any resolved program not in allowed_commands is refused. Shells are terminal (bash -c '<denied>' → bash); the unwrap is reported on decision.resolution_chain so "effective ≠ surface" is auditable. Never spawns — name resolution only.
  • New LoopbackSpawnDecision / LoopbackSpawnVerdict / LoopbackSessionSpawnError.
  • policy_presets.openclaw_cve_2026_53820_defaults(allowed_commands=…, aliases=…, denied_commands=…) — granular CVE-pinned preset (existing presets unchanged), severity=high, owasp=MCP05, cwe=(CWE-693,), cves=(CVE-2026-53820,).
  • 22 tests; built-wheel smoke confirms the alias→bash bypass is denied and python3 app.py passes. Pydantic-only core, no new runtime deps. (#99)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-53820

Assets 2
Loading