CVE-2026-53814: OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

The /hooks/agent endpoint lets automation start an agent run with a configured hook token. That token should carry only a limited scope. In affected releases, the run could select a bundled CLI backend, and that backend's spawned runtime got the owner's MCP loopback authority, not a scope fit for hook ingress.

So anyone holding the hook token could cause the CLI runtime to see or call owner-only MCP tools. The advisory's proof used persistent cron state as the sample owner-only action: a hook caller could change scheduled jobs that persist after the run. What else is exposed depends on which MCP tools your Gateway offers. With shell, file or messaging tools wired in, the reach is much wider.

The attacker needs network access to /hooks/agent and a valid hook token, which is why the vector lists low privileges. Deployments with hooks disabled are not affected. Hook tokens often sit in CI systems, webhook senders and third-party services, so a token leak becomes more serious than it looks.

Affected: npm package openclaw before 2026.5.20, where hooks are enabled, /hooks/agent is reachable with a valid hook token, and a bundled CLI backend can be selected for the hook-triggered run.

npm ls openclaw

Check your Gateway configuration to see whether hooks are on. If they are off, this flaw does not apply.

Upgrade to openclaw 2026.5.20 or later, the first stable patched version.

npm install -g [email protected]

Also keep hook tokens secret, restrict network access to hook endpoints, and disable hooks when you do not need them. After patching, rotate hook tokens that may have been exposed, and review persistent cron entries for jobs you did not create.

Review persistent cron state on the Gateway for jobs you did not create, since the reported proof used it. Check access logs for calls to /hooks/agent from unexpected sources, and for hook-triggered runs that used a bundled CLI backend and then called MCP tools. Compare the hook token's use with its intended automation callers.

Summary

OpenClaw hook ingress can start automated agent runs using a configured hook token. In affected releases, a hook-triggered run could select a bundled CLI backend that received owner-scoped MCP loopback authority instead of a scope appropriate for hook ingress.

This issue affects the boundary between hook-token automation and owner-only MCP tools. It does not affect deployments with hooks disabled.

Affected configurations

This affects deployments where hooks are enabled, /hooks/agent is reachable with a valid hook token, and a bundled CLI backend can be selected for the hook-triggered run.

Impact

A caller with the hook token could cause the spawned CLI runtime to see or call MCP tools that should have been owner-only. The practical impact depends on which MCP tools are available; the reported proof used persistent cron state as a representative owner-only action.

Patched Versions

The first stable patched version is 2026.5.20.

Fixed in the 2026.5.20 stable release.

Mitigations

Upgrade to [email protected] or later. Keep hook tokens secret, restrict network access to hook endpoints, and disable hooks when they are not needed.