Summary
The issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied sessionKey values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions.
Affected Behavior
POST /hooks/agent accepted payload sessionKey and used it directly for session routing.- Common session-key shapes (for example
agent:main:dm:<peerId>) were often derivable from known metadata, making targeted routing practical when request-level override was enabled.
Attack Preconditions
- Attacker can call hook endpoints with a valid hook token.
- Hook ingress allows request-selected
sessionKey values.
- Target session keys can be derived or guessed.
Without those preconditions, deterministic key formats alone do not provide access.
Impact
- Integrity: targeted message/prompt injection into chosen sessions.
- Persistence: poisoned context can affect subsequent turns when the same session key is reused.
- Confidentiality impact is secondary and depends on additional weaknesses.
Affected Versions
openclaw >= 2.0.0-beta3 and < 2026.2.12
Patched Versions
Fix
OpenClaw now uses secure defaults for hook session routing:
POST /hooks/agent rejects payload sessionKey unless hooks.allowRequestSessionKey=true.- Added
hooks.defaultSessionKey for fixed ingress routing.
- Added
hooks.allowedSessionKeyPrefixes to constrain explicit routing keys.
- Security audit warns on unsafe hook session-routing settings.
Recommended Configuration
{
"hooks": {
"enabled": true,
"token": "${OPENCLAW_HOOKS_TOKEN}",
"defaultSessionKey": "hook:ingress",
"allowRequestSessionKey": false,
"allowedSessionKeyPrefixes": ["hook:"]
}
}Credit
Thanks @alpernae for responsible reporting.
References
alpernae Reporter
Summary
The issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied
sessionKeyvalues on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions.Affected Behavior
POST /hooks/agentaccepted payloadsessionKeyand used it directly for session routing.agent:main:dm:<peerId>) were often derivable from known metadata, making targeted routing practical when request-level override was enabled.Attack Preconditions
sessionKeyvalues.Without those preconditions, deterministic key formats alone do not provide access.
Impact
Affected Versions
openclaw>= 2.0.0-beta3and< 2026.2.12Patched Versions
openclaw>= 2026.2.12Fix
OpenClaw now uses secure defaults for hook session routing:
POST /hooks/agentrejects payloadsessionKeyunlesshooks.allowRequestSessionKey=true.hooks.defaultSessionKeyfor fixed ingress routing.hooks.allowedSessionKeyPrefixesto constrain explicit routing keys.Recommended Configuration
{ "hooks": { "enabled": true, "token": "${OPENCLAW_HOOKS_TOKEN}", "defaultSessionKey": "hook:ingress", "allowRequestSessionKey": false, "allowedSessionKeyPrefixes": ["hook:"] } }Credit
Thanks @alpernae for responsible reporting.
References