Which versions of OpenClaw are affected by CVE-2026-43566?

OpenClaw npm package versions 2026.4.7-2026.4.13 contain a critical privilege escalation vulnerability allowing unauthenticated remote attackers to maintain elevated execution privileges during…. A patch is available.

How to fix or mitigate CVE-2026-43566?

Within 24 hours: Inventory all OpenClaw npm package deployments across development, CI/CD, and production environments and identify affected versions (2026.4.7-2026.4.13). Within 7 days: Upgrade all instances to OpenClaw version 2026.4.14 or later across all environments. Within 30 days: Conduct post-patch validation testing of affected workflows, review webhook event logs for anomalous activity during the vulnerability window, and implement network segmentation controls limiting webhook acceptance sources.

OpenClaw CVE-2026-43566

Q: What is the CVSS score of CVE-2026-43566?

CVE-2026-43566 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27283 CRITICAL

Incomplete List of Disallowed Inputs (CWE-184)

2026-05-05 VulnCheck

Privilege Escalation Openclaw

9.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 12:20 vuln.today

Analysis Generated

May 05, 2026 - 12:20 vuln.today

DescriptionCVE.org

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserve owner-like execution context when the run should have been downgraded.

AnalysisAI

Privilege escalation in OpenClaw npm package versions 2026.4.7 through 2026.4.13 allows remote unauthenticated attackers to preserve elevated execution context by sending malicious webhook wake events. The heartbeat owner downgrade logic incorrectly skips validation of untrusted webhook payloads, enabling attackers to maintain owner-like privileges during runs that should operate with reduced permissions. Vendor-released patch available in version 2026.4.14. EPSS data not available; no public exploit identified at time of analysis, though VulnCheck and security researchers from KeenSecurityLab have confirmed the vulnerability through coordinated disclosure.

Technical ContextAI

OpenClaw is an npm package implementing automated workflow/heartbeat execution with privilege separation controls. The vulnerability (CWE-184: Incomplete List of Disallowed Inputs) exists in the heartbeat owner downgrade mechanism, which enforces execution context demotion based on event trust levels. Prior to 2026.4.14, the function 'runPreparedReply' in 'get-reply-run.ts' failed to inspect 'hook:wake' event reasons during owner-downgrade checks. When webhook events carrying untrusted content arrived, the system preserved the 'senderIsOwner' flag instead of forcing it to false. The fix introduces regex pattern matching (UNTRUSTED_SYSTEM_EVENT_LINE_RE) to detect 'System (untrusted):' markers in drained system events and sets 'forceSenderIsOwnerFalseFromSystemEvents' flag, ensuring downgrade even when the initial context indicated owner privileges. The commit diff shows modified test cases validating downgrade enforcement for untrusted payloads while maintaining owner context for trusted events. This affects automated reply/agent execution workflows where external webhooks trigger internal actions.

RemediationAI

Upgrade OpenClaw to version 2026.4.14 or later via npm package manager (npm update openclaw or specify openclaw@2026.4.14 in package.json dependencies). The fix is included in the latest npm release as confirmed by the GitHub security advisory. Patch details available at https://github.com/openclaw/openclaw/pull/66031 and commit diff at https://github.com/openclaw/openclaw/commit/31281bc92f55796817a92bc43f722cba1e77ab42. If immediate upgrade is not feasible, implement compensating controls: disable or restrict webhook event processing by filtering 'hook:wake' event types at the ingress layer, enforce strict webhook source validation using cryptographic signature verification (if supported by OpenClaw's webhook handlers), or isolate OpenClaw processes using least-privilege containers/sandboxes to limit damage from privilege escalation. Note that disabling webhook functionality may break automation workflows dependent on external triggers-assess business impact before applying this mitigation. Network segmentation to restrict which systems can send webhook requests to OpenClaw instances reduces attack surface but does not eliminate risk from compromised trusted sources. No effective workaround exists for deployments requiring untrusted webhook processing; upgrade is mandatory for these environments.