CRITICAL SeverityCVSS 4.09.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVE-2026-43534

Last updated May 05, 2026 · Published May 05, 2026

Description

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

Affected products

1 listed

OpenClaw:OpenClaw

Mappings

CWE

CWE-345

CAPEC

None listed.

Guides

JWT Security Best PracticesWhat to validate, rotate, and avoid in real systems.
Secure Webhook VerificationSignature validation, replay protection, and idempotency.
Webhook Replay Attack ProtectionTime windows, nonces, and storage strategies.

CVE-2026-43534

Description

Affected products

Mappings

Related