CVE-2026-43535: Openclaw

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions.

Affected products

• Openclaw Openclaw: before 2026.4.14 (fixed in 2026.4.14)

Published 2026-05-05. Last modified 2026-06-17.