### Summary OpenClaw hook ingress can start automated agent runs using a configured hook token. In affected releases, a hook-triggered run could select a bundled CLI backend that received owner-scoped MCP loopback authority instead of a scope appropriate for hook ingress. This issue affects the boundary between hook-token automation and owner-only MCP tools. It does not affect deployments with hooks disabled. ### Affected configurations This affects deployments where hooks are enabled, `/hooks/agent` is reachable with a valid hook token, and a bundled CLI backend can be selected for the hook-triggered run. ### Impact A caller with the hook token could cause the spawned CLI runtime to see or call MCP tools that should have been owner-only. The practical impact depends on which MCP tools are available; the reported proof used persistent cron state as a representative owner-only action. ### Patched Versions The first stable patched version is `2026.5.20`. Fixed in the `2026.5.20` stable release. ### Mitigations Upgrade to `[email protected]` or later. Keep hook tokens secret, restrict network access to hook endpoints, and disable hooks when they are not needed.
### Summary OpenClaw hook ingress can start automated agent runs using a configured hook token. In affected releases, a hook-triggered run could select a bundled CLI backend that received owner-scoped MCP loopback authority instead of a scope appropriate for hook ingress. This issue affects the boundary between hook-token automation and owner-only MCP tools. It does not affect deployments with hooks disabled. ### Affected configurations This affects deployments where hooks are enabled, `/hooks/agent` is reachable with a valid hook token, and a bundled CLI backend can be selected for the hook-triggered run. ### Impact A caller with the hook token could cause the spawned CLI runtime to see or call MCP tools that should have been owner-only. The practical impact depends on which MCP tools are available; the reported proof used persistent cron state as a representative owner-only action. ### Patched Versions The first stable patched version is `2026.5.20`. Fixed in the `2026.5.20` stable release. ### Mitigations Upgrade to `[email protected]` or later. Keep hook tokens secret, restrict network access to hook endpoints, and disable hooks when they are not needed.
Update openclaw to 2026.5.20 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority affects openclaw (npm). Severity is high. ### Summary OpenClaw hook ingress can start automated agent runs using a configured hook token. In affected releases, a hook-triggered run could select a bundled CLI backend that received owner-scoped MCP loopback authority instead of a scope appropriate for hook ingress. This issue affects the boundary between hook-token automation and owner-only MCP tools. It does not affect deployments with hooks disabled. ### Affected configurations This affects deployments where hooks are enabled, `/hooks/agent` is reachable with a valid hook token, and a bundled CLI backend can be selected for the hook-triggered run. ### Impact A caller with the hook token could cause the spawned CLI runtime to see or call MCP tools that should have been owner-only. The practical impact depends on which MCP tools are available; the reported proof used persistent cron state as a representative owner-only action. ### Patched Versions The first stable patched version is `2026.5.20`. Fixed in the `2026.5.20` stable release. ### Mitigations Upgrade to `[email protected]` or later. Keep hook tokens secret, restrict network access to hook endpoints, and disable hooks when they are not needed.
AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| openclawnpm | <2026.5.20 | 2026.5.20 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate openclaw to 2026.5.20 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority affects openclaw (npm). Severity is high. ### Summary OpenClaw hook ingress can start automated agent runs using a configured hook token. In affected releases, a hook-triggered run could select a bundled CLI backend that received owner-scoped MCP loopback authority instead of a scope appropriate for hook ingress. This issue affects the boundary between hook-token automation and owner-only MCP tools. It does not affect deployments with hooks disabled. ### Affected configurations This affects deployments where hooks are enabled, `/hooks/agent` is reachable with a valid hook token, and a bundled CLI backend can be selected for the hook-triggered run. ### Impact A caller with the hook token could cause the spawned CLI runtime to see or call MCP tools that should have been owner-only. The practical impact depends on which MCP tools are available; the reported proof used persistent cron state as a representative owner-only action. ### Patched Versions The first stable patched version is `2026.5.20`. Fixed in the `2026.5.20` stable release. ### Mitigations Upgrade to `[email protected]` or later. Keep hook tokens secret, restrict network access to hook endpoints, and disable hooks when they are not needed.
AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| openclawnpm | <2026.5.20 | 2026.5.20 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard