GHSA-hv93-r4j3-q65f: OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
- Identifier
- GHSA-hv93-r4j3-q65f
- Published
- Record updated
- Affected
- openclaw >= 2.0.0-beta3, < 2026.2.12
- Fixed in
- 2026.2.12
- released February 12, 2026, 4 days before disclosure
Summary
OpenClaw's `POST /hooks/agent` endpoint used a payload `sessionKey` directly for routing, so a holder of a valid hook token could steer messages into chosen sessions when request-level override was enabled. Affected versions are `openclaw` `>= 2.0.0-beta3` and `< 2026.2.12`, and exploitation requires that the target session key can be derived or guessed.
Mitigation
Fixed in `openclaw` `2026.2.12`. The fix makes `POST /hooks/agent` reject payload `sessionKey` unless `hooks.allowRequestSessionKey=true`, adds `hooks.defaultSessionKey` and `hooks.allowedSessionKeyPrefixes`, and adds a security audit warning for unsafe settings. Recommended configuration: `"hooks": {"enabled": true, "token": "${OPENCLAW_HOOKS_TOKEN}", "defaultSessionKey": "hook:ingress", "allowRequestSessionKey": false, "allowedSessionKeyPrefixes": ["hook:"]}`.
Related items
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
- InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)