CVE-2026-53814: OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

July 2, 2026

OpenClaw hook ingress can start automated agent runs using a configured hook token. In affected releases, a hook-triggered run could select a bundled CLI backend that received owner-scoped MCP loopback authority instead of a scope appropriate for hook ingress.

This issue affects the boundary between hook-token automation and owner-only MCP tools. It does not affect deployments with hooks disabled.

References

github.com/advisories/GHSA-6fvr-66p3-3qj4
github.com/openclaw/openclaw/security/advisories/GHSA-6fvr-66p3-3qj4
nvd.nist.gov/vuln/detail/CVE-2026-53814
www.vulncheck.com/advisories/openclaw-privilege-escalation-via-hook-triggered-cli-mcp-tool-authority

Code Behaviors & Features

Detect and mitigate CVE-2026-53814 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →