Privilege Escalation in OpenClaw Versions by OpenClaw
CVE-2026-43566

9.1CRITICAL

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
5 May 2026

What is CVE-2026-43566?

Earlier versions of OpenClaw, specifically those prior to 2026.4.14, are susceptible to a privilege escalation vulnerability. This issue arises from a flaw in the heartbeat owner downgrade logic, which fails to adequately handle webhook wake events carrying untrusted content. Malicious actors can exploit this vulnerability by dispatching these untrusted webhook events, thereby maintaining an owner-like execution context when the system should have downgraded the privileges. This could lead to unauthorized actions being performed under elevated privileges.

Affected Version(s)

OpenClaw 2026.4.7 < 2026.4.14

OpenClaw 2026.4.14

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/31281bc92f557...
patch
https://www.vulncheck.com/advisories/openclaw-privilege-e...
third-party-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zsx (@zsxsoft)
KeenSecurityLab
qclawer
.