by Kastro
Paper/Archive/CVE-2026-43534

CVE-2026-43534

OpenClaw OpenClaw — OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
31
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 8.4.084 × 201.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.4.102026.4.10CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqrpatchgithub.com/openclaw/openclaw/commit/e3a845bde5b54f4f1e742d0a51ba9860f9619b29writeupvulncheck.com/advisories/openclaw-unsanitized-external-input-in-agent-hook-events