Twin auto bombs detonated in Mogadishu within moments of each other, followed by gunfire and a third blast a while later.
Hotel guards and CID officers opened fire after the twin blasts.
A witness who was inside the hotel at the time said on condition of anonymity that the front of the building was destroyed by the force of the explosions, which blew out windows.
The death toll from a triple auto bombing in Somalia's capital Mogadishu has risen to 40, including seven terrorists, a senior police officer says.
Somalia's Islamic extremist rebels, al-Shabab, claimed responsibility for the bombs, according to the group's Adalus radio station.
Police official Ibrahim Mohamed said information received from various hospitals indicated that the number of dead had reached 41, with another 106 wounded. "I could see people screaming as they fled the buses", witness Fadumo Ali told AFP on Friday. This increased the casualties.
Among the dead was the manager of the Sahafi Hotel, whose father was the owner of the hotel before he was killed in an al-Shabab attack on establishment in 2015, said police Capt. Hussein.
"The attack was opened with a martyrdom vehicle bomb blast and the fighters made their way into the building".
Al-Shabaab were forced out of the capital by African Union troops in 2011.
But they still control parts of the countryside and attack the government, military, and civilian targets, seemingly at will, in Mogadishu and regional towns.