OpenClaw before version 2026.5.20 contains a privilege‑escalation flaw where a hook‑triggered agent receives owner‑scoped MCP loopback authority instead of the intended hook scope. This weakness, classified as CWE‑266, allows an attacker who possesses a valid hook token to manipulate the "/hooks/agent" endpoint so that spawned command‑line runtimes gain access to MCP tools that should be limited to the owner. The attacker could then execute privileged actions, such as modifying persistent cron state or other owner‑only operations, thereby compromising the integrity and confidentiality of the system.

The affected product is OpenClaw from OpenClaw, Inc. Versions earlier than 2026.5.20 are vulnerable; only releases 2026.5.20 or newer provide the fix.

The CVSS score of 8.7 indicates a high‑severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a valid hook token and access to the "/hooks/agent" API. If an attacker can intercept or generate such a token, they can activate the flaw to elevate privileges. The vulnerability is exploitable in the absence of defensive controls such as strict token validation or scope restrictions.