EUVD-2026-29144
GHSA-m5j2-r859-r5cv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted system events. Attackers can exploit this trust-labeling issue to strengthen prompt-injection attacks by rendering untrusted events as trusted System events.
AnalysisAI
OpenClaw before version 2026.4.20 fails to preserve untrusted labels on webhook-triggered cron agent output, allowing events to be recorded as trusted system events instead of untrusted events. This trust-labeling issue can strengthen prompt-injection attacks by rendering attacker-controlled webhook data as legitimate system events, though it does not directly bypass authentication, tool policy, or sandboxing controls.
Technical ContextAI
OpenClaw is an npm package that manages isolated cron agent execution and session awareness events. The vulnerability exists in the cron isolated-agent delivery mechanism (specifically delivery-dispatch.ts and service/state.ts), where webhook-triggered cron job output is queued into the main session awareness stream without preserving the trusted: false flag. The affected code path involves the queueCronAwarenessSystemEvent() function and the gateway cron service wrapper (server-cron.ts). Events should carry a trusted boolean property that indicates whether an event originated from a trusted system source or untrusted external input (such as webhook triggers). When this flag is omitted, the system defaults to treating events as trusted, causing untrusted cron output to be rendered with a System: prefix instead of being marked as untrusted. This is fundamentally a data-flow issue (CWE-345: Insufficient Verification of Data Authenticity) where trust metadata is lost during event propagation across service boundaries.
RemediationAI
Upgrade OpenClaw to version 2026.4.20 or later, which preserves the trusted: false flag on isolated cron awareness events and forwards the trust property through the gateway cron wrapper. Update the npm package using npm install openclaw@2026.4.20 or npm update openclaw if already on a version compatible with 2026.x. The fix is contained in commit f61896b03cc7031f51106a04566831f4ac2a0bd7 and involves modifications to src/cron/isolated-agent/delivery-dispatch.ts, src/cron/service/state.ts, and src/gateway/server-cron.ts to ensure the trusted option is passed through the cron service dependency injection chain. No workarounds are available for versions prior to 2026.4.20; patching is the only remediation. Refer to https://github.com/openclaw/openclaw/commit/f61896b03cc7031f51106a04566831f4ac2a0bd7 for implementation details.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today