CVE-2026-43578: OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgrade
OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged context than intended.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43578?
CVE-2026-43578 has been rated as a critical severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2026-43578?
To fix CVE-2026-43578, update OpenClaw to version 2026.4.10 or later.
What does CVE-2026-43578 affect?
CVE-2026-43578 affects OpenClaw versions from 2026.3.31 up to 2026.4.10.
What type of vulnerability is CVE-2026-43578?
CVE-2026-43578 is classified as a privilege escalation vulnerability.
What causes CVE-2026-43578?
CVE-2026-43578 is caused by missed async exec completion events leading to improper heartbeat owner downgrade detection.