CVE-2026-43566: OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events
Published May 5, 2026
·Updated
OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserve owner-like execution context when the run should have been downgraded.
Affected Software
2 affected components
OpenClaw OpenClaw>=2026.4.7<2026.4.14
OpenClaw Openclaw Node.js>=2026.4.7<2026.4.14
Remediation
Event History
May 5, 2026
CVE Published
via MITRE·11:25 AM
Data Sourced
via MITRE·11:25 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-43566?
CVE-2026-43566 is classified as a privilege escalation vulnerability.
2
How do I fix CVE-2026-43566?
To mitigate CVE-2026-43566, upgrade OpenClaw to version 2026.4.14 or later.
3
What versions of OpenClaw are affected by CVE-2026-43566?
OpenClaw versions between 2026.4.7 and 2026.4.13 are affected by CVE-2026-43566.
4
What type of vulnerability is CVE-2026-43566?
CVE-2026-43566 is a privilege escalation vulnerability related to untrusted webhook wake events.
5
Can CVE-2026-43566 be exploited remotely?
Yes, attackers can exploit CVE-2026-43566 remotely through specially crafted webhook wake events.