CVE-2026-43578: Openclaw

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged context than intended.

Affected products

• Openclaw Openclaw: from 2026.3.31, before 2026.4.10 (fixed in 2026.4.10)

Published 2026-05-06. Last modified 2026-06-17.