CVE-2026-43534: OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events
Published May 5, 2026
·Updated
OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.
Affected Software
2 affected components
OpenClaw OpenClaw<2026.4.10
OpenClaw Openclaw Node.js<2026.4.10
Remediation
Event History
May 5, 2026
CVE Published
via MITRE·11:25 AM
Data Sourced
via MITRE·11:25 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-43534?
CVE-2026-43534 is considered a high severity vulnerability due to its potential for remote code execution via unsanitized input.
2
How do I fix CVE-2026-43534?
To fix CVE-2026-43534, upgrade OpenClaw to version 2026.4.10 or later.
3
What type of vulnerability is CVE-2026-43534?
CVE-2026-43534 is an input validation vulnerability that allows malicious external hook metadata to be treated as trusted events.
4
What software does CVE-2026-43534 affect?
CVE-2026-43534 affects OpenClaw versions prior to 2026.4.10.
5
Can CVE-2026-43534 lead to data breaches?
Yes, if exploited, CVE-2026-43534 can lead to unauthorized access and potential data breaches.