Openclaw cli: OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing

The OpenClaw CLI vulnerability involves the POST /hooks/agent endpoint accepting a sessionKey parameter from external requests, which is used directly for session routing. Because common sessionKey formats are often guessable or derivable, an attacker with a valid hook token can route messages into arbitrary sessions by supplying chosen sessionKey values. This leads to targeted message or prompt injection affecting session integrity and persistence of poisoned context. The vulnerability affects versions >=2.0.0-beta3 and <2026.2.12. The patch in 2026.2.12 enforces secure defaults by rejecting sessionKey payloads unless explicitly allowed, introduces a defaultSessionKey, and restricts allowed sessionKey prefixes.

The vulnerability allows an attacker with a valid hook token to inject messages into chosen sessions, compromising message integrity. This can cause persistent poisoned context affecting subsequent interactions in the same session. Confidentiality impact is limited and depends on additional vulnerabilities. There is no indication of availability impact. The overall impact is high due to the ability to manipulate session data and influence session behavior.

A fix is available in OpenClaw CLI version 2026.2.12 and later. Users should upgrade to this version or newer. The patch enforces rejecting externally supplied sessionKey values unless explicitly enabled via hooks.allowRequestSessionKey, introduces a defaultSessionKey for fixed routing, and restricts allowed sessionKey prefixes. Recommended configuration disables request-based sessionKey overrides and sets safe defaults. No further action is required if the patched version is deployed.