Which versions of OpenClaw are affected by CVE-2026-43534?

CVE-2026-43534 is a critical remote vulnerability in the OpenClaw npm package that allows unauthenticated attackers to bypass security boundaries and inject arbitrary malicious content with elevated…. A patch is available.

How to fix or mitigate CVE-2026-43534?

Within 24 hours: identify all internal and external systems running OpenClaw npm package versions before 2026.4.10 using dependency scanning tools (npm audit, SBOM analysis). Within 7 days: upgrade all instances to OpenClaw version 2026.4.10 or later; test upgrades in development environments first to validate application stability. Within 30 days: complete organization-wide inventory of OpenClaw usage, conduct post-patch validation testing, and document remediation evidence for compliance records.

OpenClaw CVE-2026-43534

Q: What is the CVSS score of CVE-2026-43534?

CVE-2026-43534 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27279 CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-05-05 VulnCheck

Privilege Escalation Openclaw

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

Source Code Evidence Fetched

May 05, 2026 - 12:19 vuln.today

Analysis Generated

May 05, 2026 - 12:19 vuln.today

DescriptionCVE.org

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

AnalysisAI

Remote unauthenticated trust boundary violation in OpenClaw npm package before 2026.4.10 allows attackers to escalate untrusted external hook input into trusted system events. By supplying malicious hook metadata, adversaries can inject arbitrary content into the agent context with elevated privileges, bypassing security boundaries intended to isolate external input from system-level operations. Vendor-released patch available (version 2026.4.10+), with no evidence of active exploitation or public exploit code at time of analysis.

Technical ContextAI

OpenClaw is an npm package implementing agent-based automation with an event-driven hook system. The vulnerability affects the gateway's hook dispatch mechanism (src/gateway/server/hooks.ts) which processes external webhook events and enqueues them as system events for agent execution. CWE-345 (Insufficient Verification of Data Authenticity) applies: the system failed to validate the trust level of incoming hook metadata before passing it to the agent runtime. The affected code path (hooks.agent-trust.test.ts confirms) allowed externally-controlled hook names to be directly inserted into system event messages without sanitization or trust demotion. The patch introduces two controls: (1) sanitizeInboundSystemTags() to strip malicious content from hook names, and (2) explicit trusted:false marking on all agent hook system events. This follows a common pattern in multi-tenant systems where external input must be explicitly downgraded to prevent privilege escalation across trust boundaries.

RemediationAI

Upgrade to OpenClaw 2026.4.10 or later (latest release 2026.4.14 confirmed to include fix per vendor advisory GHSA-7g8c-cfr3-vqqr). Patch implemented in commit e3a845bde5b54f4f1e742d0a51ba9860f9619b29 and pull request #64372 (https://github.com/openclaw/openclaw/pull/64372). For npm installations, run 'npm update openclaw' to pull fixed version. If immediate upgrade is not feasible, compensating controls include: (1) Disable external hook endpoints entirely if not required for operations - eliminates attack surface but breaks webhook-dependent workflows. (2) Implement network-level filtering to restrict hook endpoint access to trusted IP ranges only - reduces exposure but requires accurate allowlisting and may break legitimate third-party integrations. (3) Deploy OpenClaw behind a reverse proxy with payload validation rules that reject hook names containing 'System:' prefixes or other reserved keywords - adds defense layer but may cause false positives and requires ongoing rule maintenance. All workarounds reduce functionality or operational flexibility; vendor patch is strongly preferred solution.