Executive brief
OpenClaw is an AI agent framework that uses hooks to ingest external messages into chat sessions. The application allowed authenticated users with hook tokens to override the session routing key in API requests, enabling them to inject messages into any session they could identify. This could allow an attacker to poison conversation history, manipulate user interactions, and compromise the integrity of AI agent decision-making across sessions.
Technical details
The POST /hooks/agent endpoint accepted user-supplied sessionKey values in the request payload and used them directly for session routing without validation. The vulnerability is an authorization bypass (CWE-639) where a hook token holder could derive or guess session key formats (e.g., agent:main:dm:<peerId>) from known metadata and route messages to arbitrary sessions. The exploit requires a valid hook token but no user interaction. The root cause is insufficient use of random values in session key generation (CWE-330) combined with accepting external session key overrides. Fixed in version 2026.2.12 by rejecting payload sessionKey by default and introducing hooks.defaultSessionKey and hooks.allowedSessionKeyPrefixes configuration options for constrained routing.
Affected products
- OpenClaw OpenClaw >= 2.0.0-beta3, < 2026.2.12
Timeline
- 2026-02-17: disclosed
- 2026-02-12: patched