CVE-2026-43534

critical · 9.3

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

9.3

CVSS

0.2%

EPSS (exploit prob.)

9th

EPSS percentile

2026-05-05

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-345

Affected products

Vendor	Product	Affected versions
openclaw	openclaw	< 2026.4.10

Check a specific version with /api/v1/cve/match.

References

https://github.com/openclaw/openclaw/commit/e3a845bde5b54f4f1e742d0a51ba9860f9619b29
https://github.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqr
https://www.vulncheck.com/advisories/openclaw-unsanitized-external-input-in-agent-hook-events

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-43534