PT-2026-37019 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-17 · Updated 2026-05-14 · CVE-2026-43534

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description An input validation issue allows external hook metadata to be enqueued as trusted system events. Attackers can provide malicious hook names to escalate untrusted input into a higher-trust agent context.

Recommendations Update to version 2026.4.10 or newer.

Fix

LPE

Insufficient Verification of Data Authenticity

Improper Privilege Management

Weakness Enumeration

CWE-345

CWE-269

Related Identifiers

CVE-2026-43534

GHSA-7G8C-CFR3-VQQR

Affected Products

Openclaw

References · 13

• https://github.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqr · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/e3a845bde5b54f4f1e742d0a51ba9860f9619b29 · Patch
• https://osv.dev/vulnerability/GHSA-7g8c-cfr3-vqqr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43534 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/64372 · Note
• https://twitter.com/lyrie_ai/status/2054762653860426169 · Twitter Post
• https://twitter.com/UpwindMDR/status/2051721954814497076 · Twitter Post
• https://twitter.com/OrizonCyber/status/2051716069585289222 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054762656666357951 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unsanitized-external-input-in-agent-hook-events · Note
• https://t.me/CVEtracker/52734 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054762654774727119 · Twitter Post