Privilege Escalation in OpenClaw via Hook Token Misuse

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.20 and involves a privilege escalation issue. Specifically, hook-triggered agents that run incorrectly receive owner-scoped MCP loopback authority instead of the intended hook-appropriate scope. This means that attackers who have a valid hook token can exploit the /hooks/agent endpoint to cause spawned command-line interface (CLI) runtimes to access or invoke MCP tools that should only be accessible by the owner.

As a result, attackers may be able to execute privileged actions, such as modifying persistent cron states, which they should not normally be authorized to perform.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with a valid hook token to escalate their privileges and perform unauthorized actions on the affected system.

• Attackers can access or invoke owner-only MCP tools.
• They may execute privileged commands, such as modifying persistent cron jobs.
• This could lead to unauthorized system changes, persistence of malicious activities, and potential compromise of system integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should upgrade OpenClaw to version 2026.5.20 or later where the issue is patched.

• Keep hook tokens secret to prevent unauthorized access.
• Restrict network access to the /hooks/agent endpoint to trusted sources only.
• Disable hooks when they are not needed to reduce the attack surface.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers with a valid hook token to escalate privileges and perform unauthorized actions such as accessing owner-only MCP tools and modifying persistent cron state. This can lead to unauthorized access and manipulation of sensitive system functions, potentially impacting the confidentiality and integrity of data.

Such unauthorized privilege escalation and potential data manipulation could negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and system integrity.

However, the provided information does not explicitly mention compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if your OpenClaw deployment is running a version prior to 2026.5.20 and if the /hooks/agent endpoint is accessible with a valid hook token.

You should verify whether hooks are enabled and if the hook-triggered CLI runs are inheriting owner-scoped MCP loopback authority incorrectly.

Since the vulnerability involves exploitation via the /hooks/agent endpoint, monitoring network traffic for unauthorized or suspicious access to this endpoint can help detect potential exploitation attempts.

Suggested commands to assist detection might include:

• Checking OpenClaw version: `openclaw --version` or equivalent to confirm if the version is older than 2026.5.20.
• Testing accessibility of the /hooks/agent endpoint: `curl -v http://<openclaw-server>/hooks/agent` to see if the endpoint is reachable.
• Monitoring network connections or logs for usage of hook tokens or suspicious CLI runtime spawns related to hooks.

It is also recommended to restrict network access to the /hooks/agent endpoint and disable hooks if not needed to reduce risk.

Useful 0 Not Useful 0