EUVD-2026-36320
GHSA-6fvr-66p3-3qj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid hook token
-
DeliveryReach /hooks/agent over network
-
ExploitTrigger hook-driven agent run
-
ExecutionSpawned CLI inherits owner MCP scope
-
PersistInvoke owner-only MCP tools
-
ImpactModify persistent cron state for persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Requires a valid OpenClaw hook token and network reachability to the /hooks/agent endpoint on an OpenClaw instance prior to 2026.5.20; the vulnerable path is specifically hook-triggered agent runs that spawn CLI runtimes communicating with MCP tools over the loopback authority channel. No user interaction is needed (UI:N) and the attacker need not be the workspace owner (PR:L corresponds to the hook-token role), but exploitation is limited to environments where hook tokens are actually issued and where MCP loopback tools (such as cron-state management) are enabled - installations that do not use the hook subsystem or that disable owner-only MCP tools are not exposed. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) and base score 8.7 reflect a network-reachable, low-complexity flaw requiring only low privileges (a valid hook token) and no user interaction, with high confidentiality and integrity impact on the vulnerable system - consistent with the described owner-scope takeover via MCP. There is no EPSS score, SSVC decision, or KEV listing provided, and no public exploit identified at time of analysis, so this is a high-severity but not currently mass-exploited issue; the gating factor is possession of a hook token, which is realistic in multi-tenant or shared-automation deployments and unrealistic on isolated single-user installs. VulnCheck reporting plus a vendor GHSA advisory raise confidence in the technical claims, but absence of EPSS/KEV signals means prioritization should be driven by whether hook tokens are issued to less-trusted principals in the environment. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privilege hook token - for example through a leaked CI secret, a compromised integration, or a token issued for a narrow automation - sends a crafted request to /hooks/agent that triggers an agent run. The spawned CLI runtime inherits owner-scoped MCP loopback authority and is used to invoke owner-only MCP tools, modifying persistent cron state to schedule attacker-controlled jobs for follow-on execution and persistence. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Privilege escalation in OpenClaw before 2026.5.20 allows attackers holding a valid hook token to invoke owner-only MCP tools through the /hooks/agent endpoint, because hook-triggered agent runs are incorrectly granted owner-scoped MCP loopback authority. Successful exploitation lets a low-privileged hook caller execute privileged actions such as modifying persistent cron state, with no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade OpenClaw to 2026.5.20 or later, per the GHSA-6fvr-66p3-3qj4 advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-6fvr-66p3-3qj4). Until upgrade is possible, treat hook tokens as owner-equivalent: revoke or rotate any hook tokens issued to less-trusted principals, restrict network access to the /hooks/agent endpoint (for example via a reverse-proxy ACL or firewall rule limiting it to trusted automation sources), and where feasible disable hook-triggered agent runs entirely - accepting that this will break any automation that depends on hook-driven CLI execution. Monitor MCP tool invocations originating from hook-spawned runtimes (notably cron-state mutations) for anomalies as a detective control while the patch is rolled out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw exposes a hook-driven agent execution surface (/hooks/agent) that spawns CLI runtimes connected to MCP (Model Context Protocol) tools over a loopback channel. The defect is a CWE-266 (Incorrect Privilege Assignment): when a run is initiated via a hook token rather than by the owner, the spawned CLI runtime still inherits the owner's MCP loopback scope instead of a narrower hook-appropriate scope, so the privilege boundary between hook callers and the workspace owner collapses at the MCP authorization layer. The CPE 'cpe:2.3:a:openclaw:openclaw:*' indicates all versions prior to the fix release 2026.5.20 are in scope.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Network-reachable /hooks/agent endpoint, low complexity, requires a valid hook token (PR:L), no user interaction; owner-scope MCP access yields high C/I and limited availability impact via cron-state changes.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-appropriate scope. Attackers with a valid hook token can exploit the /hooks/agent endpoint to cause spawned CLI runtimes to access or invoke owner-only MCP tools, potentially executing privileged actions like persistent cron state modifications.
Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.5.20.
Executive ViewAI
OpenClaw versions before 2026.5.20 contain a privilege escalation vulnerability allowing authenticated hook users to execute owner-level operations without proper authorization. This enables unprivileged users to modify system administration settings and cron jobs, directly compromising operational governance controls. Organizations using OpenClaw for automation must upgrade immediately to prevent unauthorized administrative actions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB