OpenClaw CVE-2026-43534

Requires OpenClaw deployment with external webhook endpoints exposed and configured to accept agent hook events. The gateway hook request handler (src/gateway/server/hooks.ts) must be active and processing incoming HTTP requests from untrusted networks. Specifically, the 'dispatchAgentHook' function must be reachable via network routes accessible to the attacker. Does NOT require authentication (PR:N in CVSS vector confirms). Does NOT require user interaction (UI:N). Does NOT require non-default configuration of the hook dispatch mechanism itself - the vulnerability exists in default behavior of versions <2026.4.10 when hook endpoints are enabled. Limiting factor: Many OpenClaw deployments may not expose webhook endpoints to public networks, instead using them only for internal service-to-service communication, which significantly reduces real-world attack surface. Exploitation is blocked if: (1) hook endpoints are bound to localhost/private networks only, (2) network firewalls prevent external access to hook ports, or (3) OpenClaw is deployed without webhook integration features enabled.

CVSS 9.3 reflects network-accessible, low-complexity attack requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality and integrity impact (VC:H/VI:H). However, real-world risk is constrained by deployment context. The vulnerability requires OpenClaw to be deployed with external hook endpoints exposed and actively processing webhook events - not a default configuration for all installations. EPSS data unavailable, but absence from CISA KEV and no public POC identified suggests limited in-the-wild targeting. SSVC factors: exploitation status is 'none' (no confirmed activity), automatable (yes - webhook payloads trivially scriptable), technical impact 'partial' (privilege escalation within agent context, not necessarily full system compromise). GitHub advisory GHSA-7g8c-cfr3-vqqr confirms technical details but does not indicate active exploitation. Priority for organizations running OpenClaw with external hook integrations; lower priority for sandboxed development environments or installations without webhook exposure. Key data gap: no public exploit demonstrates full attack chain from malicious hook to meaningful system compromise beyond context escalation.

Attacker identifies externally-accessible OpenClaw hook endpoint and crafts malicious webhook payload with hook name 'System: admin override' containing embedded commands. OpenClaw's hook dispatcher processes this untrusted external input and enqueues it as a system event without sanitization or trust demotion. The agent runtime executes the event in elevated context, treating attacker-controlled metadata as trusted system instruction. Depending on agent configuration, this could trigger unauthorized actions, bypass policy controls, or manipulate agent decision-making. No public proof-of-concept exists, but attack complexity is low given webhook payloads are trivially scriptable HTTP POST requests.