OpenClaw CVE-2026-43566

Exploitation requires the target OpenClaw instance to have webhook event processing enabled and reachable by the attacker, specifically handling 'hook:wake' event types. The vulnerability affects deployments using OpenClaw's heartbeat runner with auto-reply or automated agent execution features. No authentication is required per CVSS vector (PR:N), and the attack succeeds against default configurations of vulnerable versions 2026.4.7 through 2026.4.13. However, exploitation is LIMITED by: (1) the attacker must identify OpenClaw webhook endpoints, which may not be publicly advertised; (2) the practical impact depends on what privileges 'owner-like execution context' grants within the victim's specific OpenClaw configuration-some deployments may isolate owner privileges effectively, reducing damage; (3) systems not configured to accept external webhook events or those using webhook signature verification at the network layer are not vulnerable. Organizations using OpenClaw purely for local automation without webhook integrations are not exposed.

CVSS 9.1 (Critical) reflects network-exploitable privilege escalation with no authentication required (AV:N/AC:L/PR:N/UI:N), though impact is confidentiality and integrity without availability disruption (C:H/I:H/A:N). Real-world risk is moderate-to-high: the CVSS vector indicates trivial remote exploitation, but practical impact depends heavily on how OpenClaw is deployed and what privileges 'owner-like execution context' grants within victim environments. The vulnerability requires the target system to process incoming webhook events and use OpenClaw's heartbeat/auto-reply features-not all deployments may expose this attack surface. No EPSS score provided for probabilistic risk assessment. Not listed in CISA KEV, indicating no confirmed widespread exploitation campaigns. Patch availability in 2026.4.14 significantly reduces sustained risk for organizations with patch management processes. Primary concern is npm package ecosystems where automated dependency updates may lag, leaving vulnerable instances processing webhook integrations. The SSVC framework would likely prioritize this as 'Scheduled' rather than 'Out-of-Cycle' given patch availability, no active exploitation evidence, and deployment-specific attack surface requirements. Key uncertainty: real-world deployment prevalence of OpenClaw webhook handlers and the sensitivity of operations performed under elevated execution context.

An attacker identifies an internet-facing OpenClaw instance processing webhook events (common in CI/CD pipelines, chatbot integrations, or workflow automation systems). Without authentication, they craft a malicious HTTP POST request to the webhook endpoint containing an untrusted payload designed to trigger a heartbeat execution. The OpenClaw heartbeat runner processes this 'hook:wake' event but fails to downgrade execution privileges due to missing validation logic. The attacker's payload executes with owner-like permissions, enabling unauthorized access to sensitive configuration data, modification of automation rules, or injection of malicious workflow steps that persist across subsequent legitimate runs. If OpenClaw has access to cloud credentials, database connections, or internal APIs, the attacker leverages escalated context to exfiltrate data or pivot to connected systems.