Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.20 and involves a privilege escalation issue. Specifically, hook-triggered agents that run incorrectly receive owner-scoped MCP loopback authority instead of the intended hook-appropriate scope. This means that attackers who have a valid hook token can exploit the /hooks/agent endpoint to cause spawned command-line interface (CLI) runtimes to access or invoke MCP tools that should only be accessible by the owner.

As a result, attackers may be able to execute privileged actions, such as modifying persistent cron states, which they should not normally be authorized to perform.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with a valid hook token to escalate their privileges and perform unauthorized actions on the affected system.

• Attackers can access or invoke owner-only MCP tools.
• They may execute privileged commands, such as modifying persistent cron jobs.
• This could lead to unauthorized system changes, persistence of malicious activities, and potential compromise of system integrity.

Useful 0 Not Useful 0