CVE-2026-53814: OpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool Authority

Synopsis

This is a privilege escalation vulnerability in OpenClaw versions before 2026.5.20. An attacker with a valid hook token can send a crafted request to the /hooks/agent endpoint over the network, causing spawned CLI runtimes to receive owner-level MCP tool authority instead of the restricted scope appropriate for hooks. Successful exploitation allows the attacker to invoke owner-only MCP tools, including making persistent cron state modifications and other privileged actions. A patched-image rebuild at version 2026.5.20 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the /hooks/agent endpoint over the network; the service must be exposed to the attacker's network for exploitation to be possible.

• AuthenticationRequired

  A valid hook token is required; any low-privilege account or integration that holds such a token is sufficient to trigger the vulnerability.

• Victim interactionNot required

  No user interaction is needed; the attacker submits a crafted request directly to the endpoint without involving another user.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental factors to succeed.

Blast Radius

• Reads data accessible to the owner account, including secrets, configurations, and tool outputs that the hook scope should not reach.
• Invokes owner-only MCP tools, enabling the attacker to make persistent cron state modifications and trigger privileged automation actions.
• Modifies persisted scheduling or workflow state within the OpenClaw runtime under the authority of the owner scope.
• Availability impact on the affected service is low; the service is not crashed but may behave unpredictably due to unauthorized state changes.