Home / Vulnerability Intelligence / CVE-2026-43534

CVE-2026-43534 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: May 5, 2026

OpenClaw - Privilege Escalation

Published: May 5, 2026Updated: May 5, 2026Remote Exploitable

Overview

OpenClaw < 2026.4.10 contains an input validation vulnerability caused by improper handling of external hook metadata, letting attackers escalate untrusted input into higher-trust agent context, exploit requires attacker to supply malicious hook names.

Severity & Score

Severity: Critical

CVSS Score: 9.1

Impact

Attackers can escalate privileges by injecting malicious hook names, gaining higher-trust agent context.

Mitigation

Update to version 2026.4.10 or later.

References

https://github.com/openclaw/openclaw/commit/e3a845bde5b54f4f1e742d0a51ba9860f9619b29
https://github.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqr
https://www.vulncheck.com/advisories/openclaw-unsanitized-external-input-in-agent-hook-events

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-43534
Severity: Critical
CVSS Score: 9.1
Type: broken_access_control
Status: new

CWE

CWE-345

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N