CVE-2026-43578 - Vulnerability Analysis

Overview

OpenClaw < 2026.4.10 contains a privilege escalation caused by missed local background async exec completion events in heartbeat owner downgrade detection, letting attackers escalate privileges by providing untrusted completion content.

Severity & Score

Impact

Attackers can escalate their privileges to a higher context than intended, compromising system security.

Mitigation

Update to version 2026.4.10 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-g375-h3v6-4873
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-missed-async-exec-completion-events-in-heartbeat-owner-downgrade
• https://github.com/openclaw/openclaw/commit/19a2e9ddb5a8a494abcba812bb11f51075026a27

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner