CVE-2026-43534
Path Traversal in OpenClaw before 2026.4.10
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.4.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-43534 is an input validation vulnerability in OpenClaw versions before 2026.4.10. It allows attackers to supply malicious hook names that are not properly sanitized, causing untrusted external input to be enqueued as trusted system events within the agent. This escalation lets attackers inject malicious data into higher-trust contexts, potentially leading to spoofing or injection attacks.
The vulnerability arises because agent hook events were not properly sanitized or marked as untrusted before being processed, allowing malicious hook metadata to be treated as trusted system events.
How can this vulnerability impact me? :
This vulnerability can allow attackers to manipulate system events within the OpenClaw environment by injecting malicious hook names that escalate untrusted input into trusted agent contexts.
Such manipulation can lead to unauthorized system event spoofing or injection, potentially compromising the integrity of system monitoring, logging, or automation processes that rely on these events.
Given the high CVSS score (9.3), the impact is severe and could allow remote attackers to execute attacks without any privileges or user interaction.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves unsanitized external input in agent hook events within OpenClaw before version 2026.4.10. Detection would involve monitoring or inspecting agent hook system events for suspicious or malformed hook names that could indicate injection or spoofing attempts.
Since the vulnerability is related to how OpenClaw processes hook metadata internally, detection commands would likely involve checking the OpenClaw logs or event queues for unexpected or untrusted hook names.
No specific detection commands are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade OpenClaw to version 2026.4.10 or later, as this version includes a patch that sanitizes hook names and marks agent hook system events as untrusted before enqueueing them.
The fix is included in the GitHub commit e3a845bde5b54f4f1e742d0a51ba9860f9619b29 and is available in the npm release 2026.4.14.
Until the upgrade can be applied, monitor system events for suspicious hook names and restrict access to the OpenClaw agent hooks to trusted sources only.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not explicitly describe how CVE-2026-43534 affects compliance with common standards and regulations such as GDPR or HIPAA.