GHSA-rjxq-qqhf-8hwh
HIGHGHSA-rjxq-qqhf-8hwh is a high-severity (CVSS 7.1) CWE-522 vulnerability in openclaw. O3 Security confirms whether GHSA-rjxq-qqhf-8hwh is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.
openclawnpmDescription
Summary
OpenClaw supports remote MCP Streamable HTTP servers with operator-configured custom headers. In affected releases, those headers could be forwarded when the MCP endpoint responded with a cross-origin redirect.
This issue is limited to configured MCP Streamable HTTP servers that use custom headers. It does not expose unrelated OpenClaw credentials.
Affected configurations
This affects deployments where an MCP server is configured with:
transportType: "streamable-http"- sensitive custom headers under
mcp.servers.*.headers - an MCP endpoint that is malicious, compromised, or able to redirect to another origin
Impact
Custom MCP headers, such as API keys or tenant-routing headers, could be sent to the redirect target. The exposed credential scope depends on the header the operator configured for that MCP server.
Patched Versions
The first stable patched version is 2026.5.12.
Mitigations
Upgrade to [email protected] or later. Before upgrading, avoid custom MCP headers with servers you do not fully trust, and rotate any MCP-specific credentials that may have been exposed by a redirecting endpoint.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | openclaw | all versions | 2026.5.12 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update openclaw to 2026.5.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rjxq-qqhf-8hwh is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-rjxq-qqhf-8hwh is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-rjxq-qqhf-8hwh. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-rjxq-qqhf-8hwh in your dependencies?
O3 detects GHSA-rjxq-qqhf-8hwh across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.