The 12 victims included two government officials, three hotel security guards and four civilians, a police officer said.
Three of the attackers were also killed.
Government spokesman Ismail Mukhtar Omar warned that “the death toll could rise”.
Most of the guests at the four-star hotel were rescued, but 28 injured were taken to hospital.
The al-Shabab group, linked to the international al-Qaeda network, claimed responsibility for the attack by five terrorists. Two surviving attackers are still in the hotel, where many of its employees stayed.
The hotel is owned by Somali MP and influential businessman Abdullahi Mohamed Nur. It is frequently visited by politicians, journalists and civil society representatives.